CVE-2025-7038

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and related customer fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This makes it possible for unauthenticated attackers to log into any customer’s account.

• CWE-288

• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/latepoint.php
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/controllers/steps_controller.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3366851%40latepoint&new=3366851%40latepoint&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/latepoint/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d7389e17-a357-481a-8716-3a93cb6afa7c?source=cve

Published

Sep 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-7036The CleverReach® WP plugin for WordPress is vulnerable to ti…7.5
• CVE-2025-70363Incorrect access control in the REST API of Ibexa & Ciril GR…7.5
• CVE-2025-70364An issue was discovered in Kiamo before 8.4 allowing authent…8.8
• CVE-2025-70365A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2025-70368Worklenz version 2.1.5 contains a Stored Cross-Site Scriptin…5.4
• CVE-2025-7037SQL injection in Ivanti Endpoint Manager before version 2024…7.2
• CVE-2025-7039A flaw was found in glib. An integer overflow during tempora…3.7
• CVE-2025-70397jizhicms 2.5.6 is vulnerable to SQL Injection in Article/del…7.2
• CVE-2025-7040The Cloud SAML SSO plugin for WordPress is vulnerable to una…8.2
• CVE-2025-7042Use After Free vulnerability exists in the IPT file reading …7.8
• CVE-2025-70420Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: non…
• CVE-2025-7044An Improper Input Validation vulnerability exists in the use…6.5