LatePoint CVE-2026-17538

Requires a valid authenticated session at Subscriber level or above (PR:L), which is trivial on sites that permit open user registration - a very common WordPress configuration. The core IDOR affecting first name, last name, email, phone, and notes works against default settings via the process_step_customer() function. The elevated impact - overwriting a victim's email to enable password-reset account takeover - is LIMITED to deployments where the LatePoint contact_merge setting is specifically configured to 'phone', which is a non-default/conditional prerequisite. No user interaction by the victim is required (UI:N). Limiting factors: attacker must hold a (low-privilege) account, and full account takeover depends on the contact_merge='phone' configuration.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) is internally consistent with the description: network-reachable, low complexity, and requiring only low privileges (PR:L = Subscriber-level authentication), with no user interaction. The IDOR (CWE-639) lets any logged-in low-privilege user tamper with other customers' records, which the CVSS correctly scores as Low confidentiality and Low integrity impact. However, CVSS likely UNDER-states the worst case: the description notes that when the contact_merge setting is 'phone', an attacker can overwrite a victim's email and trigger a full account takeover via password reset - an outcome closer to High integrity/confidentiality, but gated behind a non-default configuration. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability signals are absent; per the data, there is no public exploit identified at time of analysis. The practical risk hinges on whether the affected site allows open user registration (very common on WordPress) and whether contact_merge is set to 'phone'. Net: a real, patch-worthy authorization flaw that is trivially exploitable by any authenticated user, but not currently evidenced as being exploited in the wild.

An attacker registers a free Subscriber account on a WordPress site running LatePoint ≤5.6.9, then sends a crafted POST to the process_step_customer() endpoint referencing another customer's ID, merging in attacker-controlled first/last name, email, phone, and notes. Because only is_user_logged_in() gates the action, the edit succeeds without any ownership check; if contact_merge is set to 'phone', the attacker overwrites the victim's email and uses WordPress password reset to seize the account. No public POC was identified at time of analysis, and low attack complexity (AC:L) means no special timing or conditions are needed beyond a valid low-privilege login.