CVE-2025-7038: LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the stepsloadstep route of the latepointroutecall AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and related customer fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This makes it possible for unauthenticated attackers to log into any customer’s account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7038?
CVE-2025-7038 is considered a high-severity vulnerability due to its impact on authentication mechanisms.
How do I fix CVE-2025-7038?
To fix CVE-2025-7038, update the LatePoint plugin to version 5.1.95 or later.
Which versions are affected by CVE-2025-7038?
All versions of the LatePoint plugin for WordPress up to and including 5.1.94 are affected by CVE-2025-7038.
What kind of vulnerability is CVE-2025-7038?
CVE-2025-7038 is an authentication bypass vulnerability that allows unauthorized access due to insufficient identity verification.
Who is the vendor of the affected software regarding CVE-2025-7038?
The vendor of the affected software for CVE-2025-7038 is LatePoint.