Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the LatePoint WordPress plugin versions up to 5.1.94. It occurs because the plugin's change_password() function does not validate a security nonce or check user capabilities before allowing a password reset via an AJAX route. As a result, an attacker can trick a logged-in user into visiting a malicious link that resets their password without their consent, potentially taking over their account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to take over user accounts by resetting passwords without authorization. If an attacker tricks a logged-in customer or administrator into visiting a malicious link, they can gain control of that user's account, leading to unauthorized access, data theft, or further exploitation within the affected WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the LatePoint plugin to a version later than 5.1.94 where the issue is fixed. If an update is not available, disable or restrict access to the customer_cabinet__change_password AJAX route to prevent unauthorized password resets. Additionally, consider disabling the 'WP users as customers' feature if enabled, and monitor for suspicious activity related to password changes.

Useful 0 Not Useful 0