Executive Summary

CVE-2025-14873 is a Cross-Site Request Forgery (CSRF) vulnerability in the LatePoint – Calendar Booking Plugin for WordPress, affecting all versions up to and including 5.2.5.

The vulnerability exists because the 'call_by_route_name' function in the plugin's routing layer only validates user capabilities but does not enforce nonce verification. This lack of nonce checks allows unauthenticated attackers to trick a site administrator into performing administrative actions by sending forged requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform multiple administrative actions on a vulnerable WordPress site without proper authorization, provided they can trick an administrator into clicking a malicious link.

Such unauthorized administrative actions could lead to changes in site settings, manipulation of booking data, or other administrative functions that the plugin controls, potentially compromising the integrity and operation of the site.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your system is running the LatePoint WordPress plugin version 5.2.5 or earlier, which is vulnerable to Cross-Site Request Forgery due to missing nonce verification.

You can check the plugin version installed on your WordPress site by running the following WP-CLI command:

• wp plugin list --status=active

Look for the LatePoint plugin and verify if its version is 5.2.5 or below.

Additionally, monitoring HTTP requests for suspicious forged administrative actions or unexpected POST requests to plugin routes without valid nonces may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The primary mitigation step is to update the LatePoint plugin to version 5.2.6 or later, which includes nonce verification and other security improvements that prevent Cross-Site Request Forgery attacks.'}, {'type': 'paragraph', 'content': 'If immediate updating is not possible, consider restricting administrative access to trusted users only and avoid clicking on untrusted links that could trigger forged requests.'}, {'type': 'paragraph', 'content': "Implementing Web Application Firewall (WAF) rules to block suspicious CSRF attempts targeting the plugin's routes can also help mitigate risk temporarily."}] [2]

Useful 0 Not Useful 0