CVE-2026-7652: LatePoint WordPress Auth Bypass Vulnerability

CVE-2026-7652 Overview

CVE-2026-7652 affects the LatePoint plugin for WordPress in versions up to and including 5.5.0. The flaw allows unauthenticated attackers to overwrite the email address of a non-super-admin WordPress account that is not yet linked to a LatePoint customer. By abusing the guest booking flow and the standard WordPress password-reset mechanism, attackers can take over the targeted account. The issue is classified under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password]. Exploitation requires a specific plugin configuration: WordPress user integration enabled, phone-based contact merging, and customer authentication disabled. Administrator accounts on single-site installs are not affected.

Critical Impact
Unauthenticated attackers can hijack non-super-admin WordPress accounts by overwriting the linked email address and triggering a password reset to an attacker-controlled address.

Affected Products

LatePoint plugin for WordPress versions up to and including 5.5.0
Sites with WordPress user integration enabled in LatePoint
Sites with phone-based contact merging enabled and customer authentication disabled

Discovery Timeline

2026-05-09 - CVE-2026-7652 published to NVD
2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-7652

Vulnerability Analysis

The vulnerability resides in how LatePoint synchronizes customer records with linked WordPress user accounts during the unauthenticated guest booking flow. The save_connected_wordpress_user() function propagates a LatePoint customer's email address to the linked WordPress user account through wp_update_user(). The plugin performs this update without verifying that the LatePoint customer actually owns the target WordPress account. An attacker who can control the customer record can therefore force an arbitrary email change on the linked WordPress user.

Root Cause

Two design weaknesses combine to enable account takeover. First, save_connected_wordpress_user() writes the customer email into the WordPress user record without an ownership check. Second, the guest booking flow allows an unauthenticated user to overwrite an existing customer's email through a phone-based merge, with no authentication required. Together, these flaws let an attacker rewrite the email field on a WordPress account they do not control.

Attack Vector

The attack is network-based and unauthenticated. An attacker submits a guest booking that supplies the phone number of an existing LatePoint customer linked to a WordPress user. The phone-based merge logic accepts the attacker-supplied email and writes it into the customer record. The plugin then propagates this email to the connected WordPress user through wp_update_user(). The attacker subsequently triggers the standard WordPress password-reset flow, which sends the reset link to the attacker-controlled address. Administrator accounts on single-site installs are excluded because the affected code path restricts updates on super-admin accounts. Refer to the Wordfence Vulnerability Report and the affected functions in the LatePoint Customer Helper and LatePoint Steps Helper for the vulnerable code paths.

Detection Methods for CVE-2026-7652

Indicators of Compromise

Unexpected user_email changes on WordPress accounts in wp_users, especially for accounts linked to LatePoint customers.
WordPress password-reset emails issued shortly after a guest booking submission from an external IP.
LatePoint customer records updated through the guest booking flow where the phone number matches an existing customer but the email differs.
Successful logins from new IP addresses to accounts that recently had an email change.

Detection Strategies

Audit wp_users and LatePoint customer tables for email changes correlated with guest booking submissions to LatePoint endpoints.
Enable WordPress activity logging to record profile_update and retrieve_password events with originating IP and user agent.
Inspect web server access logs for booking step requests that include a phone parameter matching existing customers.

Monitoring Recommendations

Alert on any modification to the user_email field for accounts that hold the editor, author, or shop_manager roles.
Monitor outbound mail for password-reset messages sent to domains not previously associated with the recipient account.
Track repeated guest booking submissions from a single source IP that vary only by email address.

How to Mitigate CVE-2026-7652

Immediate Actions Required

Update the LatePoint plugin to a version newer than 5.5.0 as published in the WordPress LatePoint 5.5.0 to 5.5.1 changeset.
Review all non-super-admin WordPress accounts for recent email changes and reset credentials for any account with an unexplained modification.
Invalidate active sessions and force a password reset for accounts linked to LatePoint customers.

Patch Information

The vendor addressed the issue in LatePoint version 5.5.1. The fix is documented in Changeset 3522933, which modifies the save_connected_wordpress_user() flow. Administrators should upgrade through the WordPress plugin manager and verify the installed version reports 5.5.1 or higher.

Workarounds

Disable the WordPress user integration setting in LatePoint until the plugin is upgraded.
Disable phone-based contact merging in the LatePoint customer configuration.
Enable customer authentication so that booking actions require a logged-in customer rather than relying on the guest flow.
Restrict access to the LatePoint booking endpoints with a web application firewall rule that blocks repeated submissions from a single source.

bash

# Verify installed LatePoint version on the WordPress host
wp plugin get latepoint --field=version

# Update LatePoint to the patched release
wp plugin update latepoint --version=5.5.1