The LatePoint plugin for WordPress contains a flaw in the load_step route of the AJAX endpoint that authenticates users without performing identity verification, capability checks, or validating an AJAX nonce. An attacker can send a crafted request carrying any customer email and related fields; the plugin then invokes its internal login handler, causing the requested customer account to be logged in without valid credentials. This enables an unauthenticated attacker to access any customer’s account, potentially exposing personal data, booking information, and administrative settings.

All installations of the LatePoint – Calendar Booking Plugin for Appointments and Events, specifically versions up to and including 5.1.94 as distributed by LatePoint.

The CVSS score of 8.2 classifies this as a high-severity vulnerability. The EPSS score of less than 1% indicates a very low recorded exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited remotely via an unauthenticated POST request to the latepoint_route_call AJAX endpoint. An attacker needs no special credentials or system access beyond the ability to craft an HTTP request to the target WordPress site. Once the request is executed, the plugin’s internal login routine is triggered without nonce or capability verification, creating an authentication bypass that grants the attacker full access to the targeted customer account.