LatePoint – Plugin de réservation de calendrier pour rendez-vous et événements <= 5.2.5 - Cross-Site Request Forgery

This CSRF vulnerability allows an attacker to execute actions as an authenticated administrator of the WordPress site. An attacker could leverage this to create, modify, or delete appointments, change plugin settings, or potentially gain access to sensitive data stored within the plugin. The attack relies on social engineering – convincing an administrator to visit a malicious webpage crafted by the attacker. Successful exploitation could lead to significant disruption of scheduling operations and compromise of administrative privileges.

WordPress sites using the LatePoint plugin, particularly those with shared hosting environments or those where administrators are not adequately trained in security best practices, are at increased risk. Sites with legacy configurations or those that haven't implemented robust security measures are also more vulnerable.

• wordpress / composer / npm:

grep -r 'call_by_route_name' /var/www/html/wp-content/plugins/latepoint-booking-plugin/*

• generic web:

curl -I https://your-wordpress-site.com/ | grep -i 'referer'

• wordpress / composer / npm:

wp plugin list --status=active | grep latepoint

1. 2026-02-14Disclosure

   disclosure

1. Réservé2025-12-18
2. Publiée2026-02-14
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation is to upgrade the LatePoint plugin to version 5.2.6 or later, which includes the necessary nonce verification to prevent CSRF attacks. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, educate administrators about the risks of clicking on suspicious links and encourage them to regularly review plugin settings for any unauthorized changes. There are no specific configuration workarounds beyond the upgrade.

Installations actives

100KNiche

Note du plugin