CVE-2024-8911

LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified.

Affected

latepoint · LatePoint Plugin

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

2.90% chance of exploitation in the next 30 days, 87th percentile

Nuclei

critical · CWE-89

Published

2024-10-08

Updated

2026-04-08

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8911.yaml

Security advisories

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c9a23a3-5eb5-4f5b-bf32-c9d1634…
• https://wpdocs.latepoint.com/changelog

References

• CVE Record
• NVD entry