Cross-Site Request Forgery in LatePoint Plugin for WordPress
CVE-2025-7052

8.8HIGH

Key Information:

Vendor

WordPress
Status
Latepoint – Calendar Booking Plugin For Appointments And Events
Vendor
CVE Published:
30 September 2025

What is CVE-2025-7052?

The LatePoint plugin for WordPress contains a vulnerability that allows attackers to exploit missing nonce validation on the change_password() function within its AJAX endpoint. This oversight permits unauthenticated attackers to trick a logged-in user into resetting their password without their consent, potentially leading to account takeover. Administrators and customers both can be affected if they visit a malicious link designed to exploit this weakness.

Affected Version(s)

LatePoint – Calendar Booking Plugin for Appointments and Events * <= 5.1.94

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/latepoint/tags...
https://wordpress.org/plugins/latepoint/#developers

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
JSON
.
CVE-2025-7052 : Cross-Site Request Forgery in LatePoint Plugin for WordPress