LatePoint WordPress Plugin Authorization Bypass Vulnerability Allowing Insecure Direct Object References

A vulnerability allowing authorization bypass through user-controlled keys has been identified in the LatePoint WordPress plugin, specifically in versions through 5.2.6. This issue arises from incorrectly configured access control security levels, which can be exploited to bypass authorization and access sensitive files or database interactions.

Impact

Exploitation of this vulnerability could lead to insecure direct object references, allowing unauthorized access to sensitive files or database information.

Remediation

Users of the LatePoint WordPress plugin should update to version 5.2.7 or later. Patchstack users can enable auto-update for vulnerable plugins.