LatePoint Plugin CVE-2026-5365

The victim must be actively logged into WordPress as a LatePoint customer at the time of exploitation - the attack relies on the browser automatically sending the authenticated session cookie. The attacker must successfully deliver a forged request via a mechanism that causes the victim to perform an action such as clicking a link or loading a page (UI:R per CVSS). No special server-side configuration, non-default plugin settings, or privileged attacker account are required. Exploitation is limited by the social engineering prerequisite: the attacker cannot exploit this passively or at scale without individually targeting authenticated users. The SSVC Automatable: no rating confirms mass exploitation is not feasible without per-victim interaction. Defenders can assess realistic risk by considering whether their user base is likely to be targeted via phishing or malicious links.

The CVSS base score of 4.3 (Medium) reflects a limited-integrity impact with no confidentiality or availability consequence, consistent with the ability to cancel bookings but not exfiltrate data or disrupt service broadly. The CVSS vector (UI:R) is the dominant mitigating factor: exploitation requires social engineering a logged-in LatePoint customer into clicking a crafted link or visiting a malicious page. EPSS at 0.02% (7th percentile) indicates the broader security community assigns very low probability of observed exploitation, aligning with the SSVC assessment of Exploitation: none and Automatable: no. No public exploit code exists and CISA KEV status is not confirmed. Technical Impact is rated partial by SSVC, consistent with the bounded scope of canceling bookings for individual users. Overall, this is a real but operationally low-priority vulnerability: sites with high-value booking workflows (medical, legal, commercial) should treat it with more urgency than the raw score implies, while most deployments can address it through routine plugin updates.

An attacker identifies a WordPress site running LatePoint ≤ 5.3.2 and targets a customer known to have active bookings (e.g., via a publicly listed appointment system). The attacker embeds a hidden CSRF form or crafted URL in a phishing email, fake confirmation page, or social media post, then tricks the authenticated customer into clicking it, causing their browser to silently submit a cancellation request with valid session credentials. The booking is cancelled without the customer's consent, potentially causing missed appointments or business disruption. No public exploit code exists, but the attack is straightforward to implement manually given the missing nonce verification.