CVE-2024-2472: LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'startorusesessionforcustomer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2472?
The severity of CVE-2024-2472 is considered high due to the potential for unauthorized data access and modification.
How do I fix CVE-2024-2472?
To fix CVE-2024-2472, update the LatePoint Plugin to version 4.9.10 or higher.
Who is affected by CVE-2024-2472?
CVE-2024-2472 affects all versions of the LatePoint Plugin for WordPress up to and including version 4.9.9.
What could happen if CVE-2024-2472 is exploited?
If exploited, CVE-2024-2472 could allow an attacker to access or modify customer session data without authentication.
Is CVE-2024-2472 a local or remote vulnerability?
CVE-2024-2472 is a remote vulnerability, enabling unauthenticated attackers to gain access over the internet.