CVE-2025-3769 Overview
CVE-2025-3769 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress. The flaw affects all plugin versions up to and including 5.1.92. It resides in the view_booking_summary_in_lightbox function, which fails to validate a user-controlled key before returning booking data. Unauthenticated attackers can send crafted requests to retrieve appointment details, including customer names and email addresses. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated remote attackers can enumerate booking records and harvest customer personally identifiable information (PII) from any WordPress site running a vulnerable LatePoint installation.
Affected Products
- LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress
- All plugin versions up to and including 5.1.92
- WordPress installations exposing the plugin's booking endpoints to the internet
Discovery Timeline
- 2025-05-14 - CVE-2025-3769 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3769
Vulnerability Analysis
The vulnerability exists in LatePoint's customer cabinet controller, specifically in the view_booking_summary_in_lightbox action. The handler accepts a booking identifier from the client request and uses it to look up booking records without verifying that the requester owns or is authorized to view the referenced booking. Because the identifier acts as a user-controlled key, an attacker can substitute arbitrary values and receive back the corresponding record. The response discloses customer information tied to appointments, including full names and email addresses. No authentication or session context is required, and the request can be issued directly over the network.
Root Cause
The root cause is missing authorization on a user-supplied reference, matching the pattern described by CWE-639. The view_booking_summary_in_lightbox handler in customer_cabinet_controller.php trusts the booking key provided by the client and does not confirm that the caller has a valid session tied to the target record. The fix landed in the plugin's public repository as recorded in the WordPress Changeset Update.
Attack Vector
An unauthenticated attacker interacts with the plugin's public AJAX endpoint and iterates or guesses booking key values. Each successful request returns a lightbox summary containing PII for the associated appointment. The attack is fully remote, requires no user interaction, and can be automated to enumerate large numbers of records. Detailed endpoint context is available in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.
No verified proof-of-concept code is publicly available. Refer to the vendor references above for technical details of the vulnerable code path.
Detection Methods for CVE-2025-3769
Indicators of Compromise
- High-volume or sequential requests to LatePoint AJAX actions referencing view_booking_summary_in_lightbox from a single source IP.
- Access log entries containing repeated latepoint_action=view_booking_summary_in_lightbox parameters with varying booking key values.
- Unexpected outbound HTTP 200 responses from the plugin endpoint to unauthenticated clients over short intervals.
Detection Strategies
- Parse WordPress access logs for requests to admin-ajax.php or LatePoint routes invoking the view_booking_summary_in_lightbox action without an authenticated session cookie.
- Alert when a single client requests more than a defined threshold of distinct booking identifiers within a rolling time window.
- Correlate anomalous request patterns with response sizes consistent with booking summary payloads to identify scraping behavior.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized log analytics or SIEM platform for retention and query.
- Enable a web application firewall (WAF) rule set that flags IDOR-style enumeration against booking endpoints.
- Monitor customer PII egress metrics from the WordPress host, including response body sizes for the affected endpoint.
How to Mitigate CVE-2025-3769
Immediate Actions Required
- Update the LatePoint plugin to a version later than 5.1.92 that includes the fix from changeset 3291162.
- Audit recent web server and plugin logs for prior exploitation attempts against view_booking_summary_in_lightbox.
- Notify affected customers if evidence of enumeration or data disclosure is found in log review.
Patch Information
The vendor addressed the missing authorization check in the LatePoint plugin repository. Review the WordPress Changeset Update and the Wordfence Vulnerability Report for the patched code and fixed version guidance. Apply the update through the standard WordPress plugin update workflow.
Workarounds
- Temporarily disable the LatePoint plugin until the patched version can be deployed if immediate updating is not possible.
- Deploy a WAF rule that blocks unauthenticated requests to the view_booking_summary_in_lightbox action.
- Restrict access to the booking endpoint by IP allowlist for administrative or staff-only booking flows where feasible.
# Example WAF rule concept blocking unauthenticated access to the vulnerable action
# ModSecurity-style pseudo-rule
SecRule ARGS:latepoint_action "@streq view_booking_summary_in_lightbox" \
"id:1003769,phase:2,deny,status:403,\
chain,msg:'Block CVE-2025-3769 IDOR attempt'"
SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
