# CVE-2024-8911: LatePoint Plugin - SQLi

> Live exploitation tracking for CVE-2024-8911 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-8911

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** LatePoint Plugin
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The LatePoint Plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified.

## CrowdSec analysis

[CVE-2024-8911](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-8911) is a critical SQL injection vulnerability in the LatePoint plugin for WordPress, affecting versions up to 5.0.11. This flaw allows unauthenticated attackers to arbitrarily change user passwords, potentially leading to full site takeover if the "Use WordPress users as customers" setting is enabled. Even when this setting is disabled, attackers can still compromise customer accounts managed by the plugin. The vulnerability stems from improper input sanitization and insufficient SQL query preparation, making it a high-risk threat for affected WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-8911 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the LatePoint plugin by sending crafted POST requests to `/wp-admin/admin-ajax.php` with the `action=latepoint_route_call` and `route_name=customer_cabinet__change_password` parameters, injecting SQL code via the `params` field to manipulate user passwords or perform time-based SQL injection.

## Timeline

- 2024-10-08: CVE Published. CVE-2024-8911 is published to NVD.
- 2026-02-18: Rule Released. CrowdSec releases a rule to detect CVE-2024-8911 exploitation attempts against the CrowdSec Network.

## References

- https://wpdocs.latepoint.com/changelog/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8911.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-8911) follows observed exploitation activity for CVE-2024-8911. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.