The LatePoint WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the change_status function. This flaw enables attackers to perform unauthorized state changes on invoices by convincing an administrator to execute a crafted request. The vulnerability affects all versions up to 5.6.0 and can lead to integrity issues such as marking unpaid invoices as paid without authorization. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low complexity and no required privileges but requiring user interaction. No patch or official fix has been documented as of the publication date.

An attacker can exploit this vulnerability to change the status of arbitrary invoices, including marking unpaid invoices as paid, without administrator consent. This compromises the integrity of invoice data but does not affect confidentiality or availability. The attack requires tricking an administrator into performing an action such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation manually may help mitigate risk, but official guidance should be followed once provided.