LatePoint <= 4.9.91 - Cross-Site Request Forgery

Description The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.91. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...

WordPress LatePoint (Premium) plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LatePoint versions = 4.9.91...

WordPress LatePoint Plugin <= 4.9.91 is vulnerable to Cross Site Scripting (XSS)

Software LatePoint Type Plugin Vulnerable versions = 4.9.91 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43992 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c330c34a0a64 Credits Ananda Dhakal Patchstack Required...

WordPress LatePoint (Premium) plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LatePoint versions = 4.9.91...

WordPress LatePoint Plugin <= 4.9.91 is vulnerable to Cross Site Request Forgery (CSRF)

Software LatePoint Type Plugin Vulnerable versions = 4.9.91 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43945 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6bcffe080a16 Credits Ananda Dhakal Patchstack...

CVE-2024-2472

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

CVE-2024-2472

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

CVE-2024-2472

CVE-2024-2472 relates to the LatePoint WordPress plugin. Public details confirm a Missing Authorization vulnerability via IDOR in all versions ≤ 4.9.9, enabling unauthenticated attackers to view other customers’ cabinets, access PII (e.g., emails), and change a user’s LatePoint password. The root...

CVE-2024-2472 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

CVE-2024-2472 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view...

Wordpress LatePoint Plugin plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR vulnerability

Missing Authorization and Sensitive Information Exposure via IDOR vulnerability discovered by Gharib Sharifi - WaveSec, Joel Aviad Ossi in WordPress Plugin LatePoint versions = 4.9.9...

WordPress LatePoint Plugin <= 4.9.9 is vulnerable to Broken Access Control

Software LatePoint Type Plugin Vulnerable versions = 4.9.9 Fixed in 4.9.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2472 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID c507e34d06b9 Credits Gharib Sharifi - WaveSec Joel Avia...

WordPress Plugin LatePoint Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

LatePoint Plugin < 4.9.9.1 - Missing Authorization and Sensitive Information Exposure via IDOR

Description The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated...