Latepoint Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:latepoint:latepoint_plugin:4.9.9:*:*:*:*:*:*:*
part: a version: 4.9.9 update: *
| Vendor | Latepoint (2e62729d-02bb-5b2b-bb21-81d088bcfd50) |
|---|---|
| Product | Latepoint Plugin (7e44afd1-8aa8-56db-9d8f-a22ffe1c42b9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-2472 |
vulnerable | 2026-06-08 06:33:31.188718 |
LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR
CRITICAL (9.1)
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
Published: 2024-06-14T09:36:37.719Z
Updated: 2026-04-08T16:56:57.971Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.