CVE-2025-7052 is a CSRF vulnerability in the LatePoint – Calendar Booking Plugin for WordPress, affecting all versions up to 5.1.94. The vulnerability arises from missing nonce validation in the change_password() function exposed through the customer_cabinet__change_password AJAX route. Both authenticated and unauthenticated AJAX hooks (wp_ajax and wp_ajax_nopriv) are used without verifying user capabilities or nonces, enabling attackers to reset user passwords by tricking logged-in users into visiting crafted URLs. This flaw can result in full account takeover of affected users, including administrators if the 'WP users as customers' option is enabled. The CVSS 3.1 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to reset the password of a logged-in user without their consent, leading to account takeover. This compromises user confidentiality, integrity, and availability of the affected accounts. If administrators are targeted (when 'WP users as customers' is enabled), the attacker can gain administrative control over the WordPress site.

As of the provided information, no official patch or fix is confirmed or linked. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected AJAX endpoint or the 'WP users as customers' feature if possible, and avoid clicking on untrusted links while logged in. Monitor vendor channels for updates and apply official patches promptly once released.