CVE-2024-2472 - CVE House
Back to Database
Status published Critical CVE-2024-2472

LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

Vulnerability Description

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-2472

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Gharib Sharifi
  • Joel Aviad Ossi

References

More from latepoint

View All →
CVE-2025-7052
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
High 8.8
CVE-2025-7038
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
High 8.2
CVE-2025-6941
LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium 6.4
CVE-2025-6815
LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium 5.5
CVE-2025-3769
Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
Medium 5.3

Affected Vendor

Affected Software

LatePoint Plugin
Vulnerable Versions:
0

Timeline

Official Publish: June 14th, 2024
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-639

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation