CVE-2024-8943Disclosure(latepoint / latepoint)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.

latepoint CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.wordfence.com/threat-intel/vulnerabilities/id/bac8c35b-2afa-4347-b86e-2f16db19a4d3?source=cve

Other references

https://wpdocs.latepoint.com/changelog/

Weakness type (CWE)

CWE-288CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

latepoint

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-02-12); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

latepoint

Products

latepoint

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

0day Signal@0dayPublishing182d
Disclosure
🚨 CVE-2024-8943: LatePoint <= 5.0.12 - Authenticat... LatePoint's booking flow lets you auth bypass with just a user ID when WordPress integration is enabled - admin takeover... https://zerodaysignal.com/vulnerability/CVE-2024-8943 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
LatePoint version 5.0.12 or earlier permits authentication bypass through its booking flow when WordPress integration is enabled, potentially allowing an attacker to take over an admin account.
0000061
204 followersView on X
pdnuclei-bot@pdnuclei_bot237d
Disclosure
🚨 CVE-2024-8943 - critical 🚨 LatePoint <= 5.0.12 - Authentication Bypass > LatePoint plugin for WordPress versions up to 5.0.12 contains an authentication bypas... 👾 https://cloud.projectdiscovery.io/library/CVE-2024-8943 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces CVE‑2024‑8943, a critical authentication bypass in LatePoint versions ≤5.0.12, and links to a library entry that likely contains further details.
00000146
890 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	latepoint	latepoint	-	wordpress	-

Explore more

Back to dashboard latepoint CVEs latepoint vulnerabilities