Introduction
Account takeovers and unauthorized password resets have immediate business impact for any organization that uses WordPress for appointment scheduling. LatePoint is active on over 7,000 WordPress sites, where healthcare, services, and education providers rely on it as their central scheduling tool. That reach, along with its integration with customer data, makes a LatePoint vulnerability especially significant for the WordPress ecosystem.
Technical information
CVE-2025-7052 is a cross-site request forgery vulnerability in the LatePoint WordPress plugin, affecting all versions up to and including 5.1.94. The root cause is missing nonce validation in the change_password() function, which handles the customer_cabinet__change_password AJAX route and lives in the OsCustomerCabinetController class. The endpoint is registered with both wp_ajax and wp_ajax_nopriv, so authenticated and unauthenticated users can both reach it. Yet the function checks for neither a valid WordPress nonce nor user capabilities before it processes the password change request.
An attacker can therefore craft a CSRF payload, such as a hidden form or JavaScript on a malicious site, that submits a password change request on behalf of a logged-in user. If the victim visits the attacker's site while authenticated to the vulnerable WordPress instance, the browser automatically sends the session cookies with the request, and the password is reset without the user's knowledge or consent. With the "WP users as customers" setting enabled, this can also affect WordPress administrator accounts.
The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The relevant code is public:
Affected systems and versions
- Product: LatePoint WordPress plugin
- Affected versions: All versions up to and including 5.1.94
- Vulnerable configuration: All sites with LatePoint <= 5.1.94. Sites with "WP users as customers" enabled are at higher risk, because administrator accounts can be targeted.
Vendor security history
LatePoint has had multiple critical vulnerabilities in recent years. In 2024, unauthenticated authentication bypass and arbitrary password change vulnerabilities were reported (see Wordfence 2024 advisory). The vendor has generally shipped timely patches. Still, basic issues such as missing nonce validation and improper access controls keep recurring, which points to persistent gaps in its secure development practices and code review.
