LatePoint CVE-2026-103380

Requires an authenticated subscriber-level (or higher) account on the target site, so exploitation depends on the site permitting self-registration or otherwise granting low-privilege accounts. The attacker must be able to reach the customer_cabinet__update route to write a template placeholder (e.g. {{customer_admin_notes}}) into their own first_name field, then invoke the LatePoint password-reset/notification email flow that renders customer fields through the vulnerable replacer_helper. Limiting factors: authentication is mandatory (not remote-unauthenticated), the leak is confined to data exposed in rendered LatePoint notification emails, and it only affects installations running LatePoint versions up to and including 5.7.3; the attacker only receives data to an address they control rather than achieving code execution or data modification.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: the attack is network-reachable through the WordPress customer cabinet, requires only low privileges (subscriber-level, which maps to PR:L), needs no victim interaction, and yields a confidentiality-only impact rated Low with no integrity or availability effect. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no signal of active exploitation or published exploit code - no public exploit identified at time of analysis. The signals are therefore consistent rather than conflicting: a real, reproducible data-exposure flaw (clearly understood via the Wordfence advisory and linked source-code lines) that is self-service exploitable by any registered low-privilege user but limited in blast radius to leaking booking-related data (admin_notes, agent internal contact details, transaction tokens, payment request URLs) rather than full account takeover. The main risk amplifier not captured by the base score is that transaction tokens and payment request URLs could enable follow-on abuse, so the Low confidentiality rating may understate downstream impact. Missing data to note: no EPSS, no KEV, no explicit POC - exploitation likelihood is inferred, not confirmed.

A subscriber-level user registers on a WordPress site running LatePoint, then uses the customer_cabinet__update route to store a template placeholder such as {{customer_admin_notes}} in their own first_name field. They trigger the password-reset email flow, and the notification mailer expands the placeholder server-side, delivering privileged booking data (admin notes, agent contact details, transaction tokens, payment URLs) to the attacker's inbox. No public exploit code was identified, but the technique is fully described in the Wordfence advisory and the attack complexity is low.