Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-7652

The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions up to, and including, 5.5.0 This is due to the save_connected_wordpress_user() function propagating a LatePoint customer's email address to its linked WordPress user account via wp_update_user() without any ownership verification, combined with the guest booking flow's ability to overwrite an existing customer's email through phone-based
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:83afab1030f3b8fa9460cd6723ab9168a8974964de54a859c3f47e91d9fb9112
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"LatePoint – Calendar Booking Plugin for Appointments and Events","vendor":"latepoint","versions":[{"lessThanOrEqual":"5.5.0","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-640","description":"CWE-640 Weak Password Recovery Mechanism for Forgotten Password","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/problemTypes/0/descriptions/0

Source references

15 source assertions
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/latepoint.php#L1165"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/11
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/customer_helper.php#L238"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1940"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1972"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/12
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/latepoint.php#L1165"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L238"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/10
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php#L1940"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/8
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php#L1972"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/latepoint.php#L1165"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/customer_helper.php#L238"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/9
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/steps_helper.php#L1940"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/7
{"url":"https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/steps_helper.php#L1972"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/changeset/3522933/latepoint/trunk/latepoint.php"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/13
{"url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Flatepoint/tags/5.5.0&new_path=%2Flatepoint/tags/5.5.1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/14
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bdaa32cd-a148-4554-9fd5-f5b0a5b2d1c3?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4f695265da0acf99a607c770732d993773561608c956f47f745aa83699ba19b3 · sha256:5aeedd5e45ceb345… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer