CVE-2024-43945: Latepoint CSRF Vulnerability

CVE-2024-43945 Overview

CVE-2024-43945 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the LatePoint plugin for WordPress. The flaw impacts all versions from initial release through 4.9.91. An attacker can craft a malicious web page that, when visited by an authenticated LatePoint user, triggers unauthorized state-changing actions on the target site. Successful exploitation can compromise confidentiality, integrity, and availability of the affected WordPress installation. The vulnerability is classified under CWE-352 and requires user interaction to succeed.

Critical Impact
An authenticated user visiting an attacker-controlled page can be forced to execute privileged actions in the LatePoint plugin, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

LatePoint WordPress plugin versions up to and including 4.9.91
Vendor: Latepoint
Platform: WordPress

Discovery Timeline

2024-10-21 - CVE-2024-43945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43945

Vulnerability Analysis

The LatePoint plugin fails to properly validate the origin of state-changing HTTP requests. Without adequate anti-CSRF tokens or origin checks, the plugin accepts forged requests as if they came from a legitimate authenticated session. An attacker hosts a page containing a crafted form or JavaScript that submits requests to the vulnerable LatePoint endpoint. When an authenticated administrator or privileged user visits that page, the browser automatically attaches session cookies, and the plugin processes the request. This design flaw allows attackers to trigger administrative operations without direct access to credentials.

Root Cause

The root cause is missing or insufficient CSRF protection on sensitive LatePoint request handlers. The plugin does not verify a valid WordPress nonce or equivalent unpredictable token before processing state-changing operations. This maps to CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation requires network access and user interaction. The attacker must convince an authenticated LatePoint user, typically an administrator, to click a link or load a page containing the malicious request. Because the attack rides on the victim's existing session, no credentials are needed from the attacker. The scope is unchanged, and the resulting actions inherit the privileges of the tricked user.

See the Patchstack Vulnerability Database Entry for the vendor-coordinated disclosure record.

Detection Methods for CVE-2024-43945

Indicators of Compromise

Unexpected LatePoint configuration changes, appointment modifications, or new administrative bookings without corresponding admin console activity.
WordPress access logs showing POST requests to LatePoint endpoints with Referer or Origin headers pointing to unrelated third-party domains.
Authenticated sessions issuing state-changing requests immediately after visiting external URLs in browser history.

Detection Strategies

Inspect web server access logs for LatePoint plugin endpoints (/wp-admin/admin-ajax.php and /wp-admin/admin-post.php with LatePoint action parameters) where the Referer header is missing or off-domain.
Alert on privileged WordPress account activity that lacks a preceding wp-login.php authentication event in the same session window.
Correlate outbound browsing telemetry from admin workstations with subsequent state-changing requests to the WordPress site.

Monitoring Recommendations

Enable and centralize WordPress audit logging for all LatePoint administrative actions.
Deploy a Web Application Firewall (WAF) rule set that flags POST requests to LatePoint handlers missing valid nonce parameters.
Monitor plugin version inventory across WordPress fleets to identify hosts still running LatePoint 4.9.91 or earlier.

How to Mitigate CVE-2024-43945

Immediate Actions Required

Upgrade the LatePoint plugin to a version later than 4.9.91 that includes the CSRF fix, as documented on the Patchstack advisory.
Restrict WordPress administrative access to trusted networks and require re-authentication for sensitive operations.
Instruct administrators to log out of WordPress when not actively managing the site to shrink the CSRF attack window.

Patch Information

A fixed release is available from the LatePoint vendor. Refer to the Patchstack Vulnerability Database Entry for the coordinated advisory and update guidance. Verify the installed plugin version in the WordPress plugins dashboard after applying the update.

Workarounds

Deploy WAF rules that block requests to LatePoint endpoints lacking a valid WordPress nonce (_wpnonce) parameter.
Enforce SameSite=Lax or SameSite=Strict cookies on the WordPress session cookie to reduce cross-site request delivery.
Temporarily disable the LatePoint plugin if immediate patching is not feasible and the booking functionality is not business-critical.

bash

# Example: WP-CLI check and update for LatePoint
wp plugin get latepoint --field=version
wp plugin update latepoint
wp plugin get latepoint --field=version