The LatePoint plugin for WordPress allows an unauthenticated attacker to perform account takeover by exploiting its weak password‑recovery process. The save_connected_wordpress_user() function propagates a customer’s email address to the linked WordPress account without verifying ownership. Combined with a guest booking flow that can overwrite an existing customer’s email through phone‑based merging without authentication, an attacker can change the email address of a non‑super‑admin user that is not yet linked to LatePoint. Once the email is changed to an address controlled by the attacker, the attacker can trigger WordPress’s standard password‑reset flow and regain full control of the account.

This flaw exists in LatePoint version 5.5.0 and earlier. The affected product is the LatePoint Calendar Booking Plugin for WordPress, which integrates with the WordPress user system. The vulnerability does not affect administrator accounts on single‑site installs, but any non‑super‑admin WordPress user account that is not linked to a LatePoint customer and whose account recovery settings are enabled is potentially vulnerable.

The CVSS score of 5.3 places the vulnerability in the moderate range. Although the EPSS score is not available, the lack of a requirement for privileged access and the possibility of performing the exploit purely from the public face of the plugin make the risk appreciable. The flaw is not listed in the CISA KEV catalog. An attacker could interact with the plugin’s guest booking form to trigger the email overwrite and then use the normal WordPress password‑reset link to complete the account takeover.