Authentication Bypass in LatePoint Plugin for WordPress

CVE-2025-7038

What is CVE-2025-7038?

The LatePoint plugin for WordPress contains a significant vulnerability that allows unauthorized access to customer accounts through an authentication bypass. This issue arises from inadequate identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint across all versions up to and including 5.1.94. Due to the absence of proper login status verification, capability checks, and valid AJAX nonce implementations, attackers can exploit this flaw. By providing a customer email and related fields, unauthenticated users are able to log into any customer’s account, posing a serious security risk for users relying on this plugin.

References