What’s Vulnerable › Vulnerabilities

CVE-2024-2472: LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-14 · updated 2026-06-17
• Weakness: CWE-639

Description

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.

Affected products

• LatePoint: before 4.9.91 — fixed in 4.9.91

How to fix

Upgrade to a fixed version: LatePoint 4.9.91. Check the vendor advisory for mitigations.

References

• https://aramhairchitects.nl/
• https://websec.nl/blog/critical-idor-vulnerability-in-latepoint-plugin-exposes-sensitive-data-666b78446e63d6dcdb0f73bf
• https://wpdocs.latepoint.com/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d?source=cve
• https://aramhairchitects.nl/
• https://wpdocs.latepoint.com/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6215fa9f-06bc-4dc8-b1f5-a3bb75749f1d?source=cve

Get alerted when CVE-2024-2472 or the next vulnerability affects your stack