Overview
CVE-2025-7052 is a critical Cross-Site Request Forgery (CSRF) vulnerability that affects the LatePoint plugin for WordPress, a popular appointment booking plugin. It impacts all versions up to and including 5.1.94. This vulnerability could allow unauthenticated attackers to take over a user’s account by tricking them into visiting a malicious link. It’s a serious issue because WordPress powers approximately 40% of all websites worldwide, and the LatePoint plugin is widely used for scheduling and managing appointments.
Vulnerability Summary
CVE ID: CVE-2025-7052
Severity: High – CVSS 8.8
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
LatePoint WordPress Plugin | Up to and including 5.1.94
How the Exploit Works
The vulnerability lies in the missing nonce validation on the change_password() function of the customer_cabinet__change_password AJAX route in the LatePoint plugin. The plugin hooks this endpoint via wp_ajax and wp_ajax_nopriv but does not verify a nonce or user capability before resetting the user’s password. This omission makes it possible for an attacker to reset the user’s password without their knowledge or consent. An attacker could exploit this vulnerability by tricking a logged-in customer or an administrator into visiting a malicious link.
Conceptual Example Code
Here’s a conceptual representation of how the CSRF attack might be launched against the vulnerable endpoint:
POST /wp-admin/admin-ajax.php?action=latepoint_customer_cabinet__change_password HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
new_password=attacker_password&confirm_new_password=attacker_passwordIn the above example, an attacker sends a POST request to the change password AJAX route in the LatePoint plugin. The new_password and confirm_new_password parameters are set to the attacker’s desired password.
Mitigation Guidance
To mitigate this vulnerability, users of the LatePoint WordPress plugin should apply the vendor’s patch as soon as it becomes available. In the meantime, users can use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) as a temporary mitigation measure. These tools can help detect and block malicious traffic targeting the vulnerable endpoint.
