LatePoint Plugin - Authentication Bypass (CVE-2024-8943)
Description
The LatePoint Plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supplied during the booking customer step. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id. Note that logging in as a WordPress user is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. The vulnerability is partially patched in version 5.0.12 and fully patched in version 5.0.13.
psychologyCrowdSec Analysis
CVE-2024-8943 is a critical authentication bypass vulnerability in the LatePoint Plugin for WordPress, affecting versions up to 5.0.12. This flaw allows unauthenticated attackers to log in as any existing user, including administrators, if they know the user ID and the "Use WordPress users as customers" setting is enabled. Exploiting this vulnerability could lead to full site compromise, data theft, or unauthorized administrative actions. The issue is fully resolved in version 5.0.13.
CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-8943 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit endpoints such as /wp-admin/admin-ajax.php with the action=latepoint_route_call parameter to bypass authentication and log in as any user by supplying a valid user ID, often obtained from /wp-json/wp/v2/users or similar REST API routes.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-08 |
| Rule Released | 2026-02-18 |
| CrowdSec First Seen | 2026-03-11 |
Related Weaknesses
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.