LatePoint WordPress Plugin EUVD-2026-28881

Exploitation requires a specific combination of plugin configuration settings, all of which must be enabled together: WordPress user integration must be enabled in LatePoint settings so that the save_connected_wordpress_user() function is active and customer emails can be propagated to WordPress accounts; phone-based contact merging must be enabled in the guest booking flow configuration to allow email overwrites without authentication; and customer authentication must be disabled in the guest booking flow, permitting unauthenticated visitors to submit merge requests and overwrite existing customer email addresses. Additionally, the target WordPress user account must not already be linked to a LatePoint customer (because an existing link would prevent the email-overwrite merge), and the target must not hold super-admin privileges (super-admins on single-site installs are explicitly excluded from vulnerability). The attack is not possible against administrator accounts on single-site WordPress installations due to WordPress's built-in protections for administrative users. If any of the three configuration requirements are not met (e.g., customer authentication is enabled, or phone-based merging is disabled), the vulnerability cannot be exploited. These are non-default settings, which limits the practical scope significantly.

The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U) correctly reflects network-based unauthenticated exploitation with low attack complexity and no user interaction required. However, real-world risk is substantially higher than the CVSS score suggests because the vulnerability enables full account takeover (not merely integrity impact), and the attack chain is deterministic once preconditions are met. The moderate CVSS rating is artificially depressed by the Scope:Unchanged classification and the integrity-only impact metric, which do not capture that email modification directly enables authentication bypass. EPSS exploitation probability data is not provided in the input, but the exploitation conditions are highly specific and narrow the actual attack surface: the plugin must be configured with three non-default settings (WordPress user integration, phone-based merging, and customer authentication all disabled). Organizations using LatePoint with customer authentication enabled or without phone-based merging face zero risk. The attack requires either reconnaissance to identify eligible targets (non-super-admin WordPress users not yet linked to LatePoint) or broad exploitation attempts. The absence of reported active exploitation in the wild and lack of public POC suggest this remains a low-prevalence threat, but the ease of exploitation (a few HTTP requests to the guest booking endpoint) and the high impact (full WordPress account compromise) make this a priority for organizations matching the vulnerable configuration profile. The limiting factor is configuration-dependent rather than technical: many LatePoint deployments likely have customer authentication enabled by default, which would completely mitigate this vulnerability.

An attacker identifies a WordPress site running vulnerable versions of LatePoint and checks the plugin configuration to confirm WordPress user integration, phone-based merging, and customer authentication are enabled as needed. The attacker then submits a guest booking request for a target non-super-admin user (e.g., editor or author account discovered via WordPress author enumeration), using the phone-based customer merge feature to set the target's email address to an attacker-controlled account. The attacker then visits the WordPress login page, clicks 'Lost your password?', enters the target's username, and receives a password reset link at their controlled email address. The attacker clicks the reset link, sets a new password, and logs in as the compromised user with full access to that user's WordPress capabilities (e.g., post editing, plugin management, depending on the user role).