Introduction
Attackers can gain access to any customer account on thousands of WordPress sites running LatePoint by sending a crafted request to a public AJAX endpoint. LatePoint is a popular appointment booking plugin for WordPress, with over 7,000 active installations. The critical authentication bypass, CVE-2025-7038, was disclosed on September 30, 2025, and affects all versions up to and including 5.1.94. It lets unauthenticated attackers log in as any customer and see that customer's personal and business data. Small and medium businesses use LatePoint widely to manage appointments, so the flaw hits both those service providers and their clients.
Technical Information
CVE-2025-7038 comes from how the LatePoint plugin handles AJAX requests during appointment booking. The flaw is in the steps__load_step route of the latepoint_route_call AJAX endpoint. The endpoint is exposed to unauthenticated users through WordPress's wp_ajax_nopriv_ action registration, so anyone can call it without logging in.
A request to /wp-admin/admin-ajax.php with the action parameter set to latepoint_route_call and the route parameter set to steps__load_step makes the plugin read client-supplied fields such as the customer email and other identifying information. The code then passes these values to the internal login handler. It does not check whether the requester is already authenticated, it runs no capability checks, and it does not validate a WordPress AJAX nonce. Any remote attacker who supplies a LatePoint customer's email address is therefore logged in as that customer, with access to all of that customer's data.
The root cause is that the AJAX handler has no authentication or authorization checks while the endpoint is open to unauthenticated users. In LatePoint version 5.1.93, the vulnerable logic is in these files:
latepoint.phplib/controllers/steps_controller.php
The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Exploiting it takes no credentials and no prior access. The attacker only needs a target customer's email address, which can often be guessed or harvested from public sources.
Detection Methods
General vulnerability detection uses several methods, each suited to particular kinds of security flaws:
- Static Application Security Testing (SAST) analyzes source code or binaries without running the program. It catches flaws such as buffer overflows, injection flaws, and hard-coded secrets early in the development lifecycle. Common tools include Checkmarx, Fortify, SonarQube, and Veracode. (audit3a.com)
- Dynamic Application Security Testing (DAST) tests the running application for vulnerabilities that appear during execution. Tools such as OWASP ZAP, Burp Suite, and Acunetix simulate attacks like cross-site scripting (XSS) and SQL injection to find issues that arise from real user interactions. (audit3a.com)
- Penetration testing, also called ethical hacking, simulates real-world attacks to find exploitable vulnerabilities. Testers combine manual techniques with automated tools like Metasploit and Kali Linux to assess an application's security posture. (audit3a.com)
- Code review means developers or security experts inspect the codebase by hand for security flaws, logic errors, and poor coding practices that might lead to vulnerabilities. Reviewers concentrate on authentication, authorization, error handling, and data input/output. (audit3a.com)
- Dependency scanning covers the third-party libraries and frameworks that applications rely on, which can introduce vulnerabilities if they are not properly managed. Tools like Snyk, WhiteSource, and OWASP Dependency-Check compare component versions against databases of known issues. (audit3a.com)
- Fuzz testing feeds large amounts of random, malformed, or unexpected data into an application to find input-handling vulnerabilities such as memory corruption or buffer overflows. Tools include American Fuzzy Lop (AFL) and Peach Fuzzer. (audit3a.com)
- Security audits are comprehensive reviews of software and its systems by security professionals. Auditors examine configuration files, access control policies, encryption standards, and overall system architecture, using tools like OpenVAS, Nexpose, and Nessus. (audit3a.com)
- Threat modeling identifies and prioritizes potential threats to an application. By working through attack vectors in advance, developers can anticipate and mitigate vulnerabilities before they are introduced. (audit3a.com)
- Deep learning-based detection, used by methods such as VulDeePecker, analyzes code snippets for vulnerabilities. It depends less on manual feature engineering and can identify complex patterns that indicate security flaws. (arxiv.org)
- Knowledge graph-based detection analyzes the relationships between code components. It gives a better picture of code semantics and can identify multi-level network source code vulnerabilities. (link.springer.com)
- Automated tools for specific vulnerabilities, such as Log4j-CVE-Detect, use YARA rules to find one known flaw, in this case the Log4j versions affected by CVE-2021-44228. These tools can analyze binary artifacts to identify vulnerable components. (github.com)
Detection reference: Wordfence Threat Intelligence
Affected Systems and Versions
CVE-2025-7038 affects all versions of the LatePoint plugin for WordPress up to and including 5.1.94. Any WordPress installation with LatePoint 5.1.94 or earlier is vulnerable while the plugin is active. Configuration makes no difference, because the affected AJAX endpoint is exposed by default.
Vendor Security History
LatePoint has a documented history of authentication and input validation flaws. In October 2024, Wordfence disclosed two critical vulnerabilities in LatePoint versions up to 5.0.12: an authentication bypass and an arbitrary password change via SQL injection. The vendor patched them, and the plugin is actively maintained, with regular updates and timely responses to security advisories. Even so, the recurring authentication issues indicate persistent architectural weaknesses, and the pattern suggests the plugin needs a deeper architectural review.
