CVE-2024-2472 CRITICAL

CVE-2024-2472: LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

Vendor Latepoint

Product LatePoint Plugin

Weakness CWE-639 · IDOR

Published June 14, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to and including 4.9.9. This makes it possible for unauthenticated attackers to view other customer's cabinets, including the ability to view PII such as email addresses and to change their LatePoint user password, which may or may not be associated with a WordPress account.

Key dates

02Disclosure timeline

June 14, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-2472 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2024-27302 Authorization Bypass Through User-Controlled Key in go-zero CVE-2026-5138 Foreman: foreman: information disclosure via improper validation of nested request parameters CVE-2026-6612 TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization CVE-2026-41949 Dify < 1.14.2 Authorization Bypass via File Preview Endpoint CVE-2024-9215 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover