CVE-2026-7652
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The LatePoint plugin for WordPress up to version 5.5.0 is vulnerable to account takeover due to a weak password recovery mechanism in the unauthenticated guest booking flow. The save_connected_wordpress_user() function propagates a LatePoint customer's email to the linked WordPress user account without ownership verification, and the guest booking flow can overwrite an existing customer's email via phone-based merge without authentication.
Risk Assessment
Unauthenticated attackers can overwrite the email address of a non-super-admin WordPress user account not yet linked to a LatePoint customer, then trigger the standard password-reset flow to gain full account control.
Recommendation
Update the LatePoint plugin to the latest patched version. If possible, disable WordPress user integration, phone-based contact merging, or require customer authentication.
Original NVD description (English source)
The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions up to, and including, 5.5.0 This is due to the save_connected_wordpress_user() function propagating a LatePoint customer's email address to its linked WordPress user account via wp_update_user() without any ownership verification, combined with the guest booking flow's ability to overwrite an existing customer's email through phone-based merge without authentication. This makes it possible for unauthenticated attackers to overwrite the email address of a non-super-admin WordPress user account that is not yet linked to a LatePoint customer, enabling full account takeover by subsequently triggering the standard WordPress password-reset flow to the attacker-controlled address granted the plugin is configured with WordPress user integration enabled, phone-based contact merging, and customer authentication disabled. Administrator accounts on single-site installs are not affected.