The LatePoint plugin for WordPress suffers from an account takeover vulnerability due to a weak password recovery mechanism in its unauthenticated guest booking flow. The save_connected_wordpress_user() function updates a LatePoint customer's linked WordPress user email via wp_update_user() without verifying ownership. Combined with the guest booking flow's ability to overwrite an existing customer's email through phone-based merge without authentication, this allows attackers to overwrite the email of a non-super-admin WordPress user account not yet linked to a LatePoint customer. Attackers can then trigger the standard WordPress password reset flow to the attacker-controlled email, resulting in full account takeover. Administrator accounts on single-site installs are not affected.

An unauthenticated attacker can overwrite the email address of a non-super-admin WordPress user account linked to LatePoint and subsequently reset the password via WordPress's standard password reset mechanism. This leads to account takeover of affected user accounts. The vulnerability does not impact administrator accounts on single-site WordPress installations. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation level has been published by the vendor. Users should monitor the vendor advisory for updates. Until a patch is available, consider disabling WordPress user integration, phone-based contact merging, or enabling customer authentication in the LatePoint plugin to reduce exposure to this vulnerability.