LatePoint CVE-2026-57714

No special conditions - remote unauthenticated exploitation is possible against default configurations of the LatePoint plugin, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The prerequisite is simply that a reachable WordPress site has LatePoint (≤ 5.6.3) installed and active and exposes the vulnerable booking/AJAX request handler to the attacker. Limiting factors: exploitation is 'blind', so data extraction is slower and requires many inference requests (making it noisier and rate-limitable); impact is read-oriented (C:H, I:N) so this does not by itself grant write/RCE; and a WAF or access controls in front of the plugin endpoints can raise the practical difficulty. The exact vulnerable parameter/endpoint is not disclosed in the provided data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a high-priority, remotely reachable, unauthenticated, low-complexity flaw, and the 9.3 score is elevated by S:C (scope change) reflecting access to the broader database. However, the impact profile is asymmetric - C:H, I:N, A:L - meaning the vendor scored this primarily as a confidentiality/read-oriented issue, not full database write or takeover, which is consistent with a blind SQLi used to exfiltrate data. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified here. There is no KEV listing and no POC referenced, so this is a credible high-severity issue but not confirmed to be under active exploitation; the WordPress plugin attack surface and Patchstack's involvement make opportunistic scanning plausible once details circulate. Note a minor tension worth verifying: I:N/A:L limits impact to reads and minor availability effects, so raw 9.3 may overstate operational risk versus a full RCE - prioritize based on whether sensitive customer/PII booking data is stored.

An unauthenticated attacker locates a WordPress site running LatePoint and sends crafted parameters to a vulnerable booking or AJAX endpoint, embedding SQL that the plugin passes to the database without sanitization. Using boolean or time-based blind techniques (e.g., conditional delays), the attacker iteratively infers and extracts sensitive data such as administrator password hashes from wp_users or customer PII from booking tables. No public POC is referenced, but the low attack complexity and no-authentication requirement make automated exploitation with tools like sqlmap straightforward once the parameter is known.