LatePoint WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the LatePoint plugin for WordPress, affecting all versions through 5.3.2. The issue arises from a lack of nonce verification in the request_cancellation() function, allowing unauthenticated attackers to cancel bookings for logged-in customers by sending a forged request. This exploitation requires tricking the customer into clicking a link or performing a similar action.

Impact

Exploitation of this vulnerability allows for unauthorized cancellation of a logged-in customer's bookings.

Remediation

Users are advised to update the LatePoint WordPress plugin to version 5.4.0 or later.