LatePoint Plugin vulnerabilities

3 known vulnerabilities in LatePoint Plugin from LatePoint. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  LatePoint Plugin: Missing Authentication for Critical Functionality

  CVE-2024-8943Oct 8, 2024LatePointEPSS 3.08%

  The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated

• 9.8 Critical severity

  LatePoint Plugin: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-8911Oct 8, 2024LatePointEPSS 2.9%

  The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin

• 9.1 Critical severity

  LatePoint Plugin: Authorization Bypass Through User-Controlled Key

  CVE-2024-2472Jun 14, 2024LatePoint

  The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possi