CVE-2025-3769

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3769", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-04-17T15:37:44.705Z", "datePublished": "2025-05-14T11:12:25.594Z", "dateUpdated": "2026-04-08T17:03:11.190Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:11.190Z"}, "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.92", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses."}], "title": "Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3291162/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Martin Martin"}], "timeline": [{"time": "2025-05-13T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-14T13:27:58.887787Z", "id": "CVE-2025-3769", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T13:28:22.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-14T13:27:58.887787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T13:28:06.697Z"}}], "cna": {"title": "Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference", "credits": [{"lang": "en", "type": "finder", "value": "Martin Martin"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.92"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-13T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3291162/"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:11.190Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3769", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:11.190Z", "dateReserved": "2025-04-17T15:37:44.705Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-14T11:12:25.594Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "vendor": "latepoint", "versions": [{"lessThanOrEqual": "5.1.92", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses."}, {"lang": "es", "value": "El complemento LatePoint \u2013 Calendar Booking Plugin for Appointments and Events para WordPress es vulnerable a una Referencia Directa a Objetos Insegura en todas las versiones hasta la 5.1.92 incluida, a trav\u00e9s de 'view_booking_summary_in_lightbox', debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto permite a atacantes no autenticados obtener detalles de las citas, como nombres y direcciones de correo electr\u00f3nico de los clientes."}], "id": "CVE-2025-3769", "lastModified": "2026-06-17T09:20:38.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3769", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-14T13:27:58.887787Z", "version": "2.0.3"}}]}, "published": "2025-05-14T12:15:18.747", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3291162/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:49:50.406506+00:00", "value": {"mitigation_remediation": ["Upgrade the LatePoint plugin to version 5.1.93 or newer to receive the security fix", "If an immediate upgrade is not possible, block unauthenticated access to booking summary pages, for example by requiring user login or adding a WordPress capability check before rendering the summary", "Implement input validation or access control checks on any user-supplied identifiers used to retrieve booking information to prevent direct object reference"], "summary": {"action": "Immediate patch", "impact": "Information disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the LatePoint \u2013 Calendar Booking Plugin for Appointments and Events up to and including version 5.1.92. No other affected products or versions are specified.", "description_and_impact": "The LatePoint Calendar Booking Plugin for WordPress contains an insecure direct object reference vulnerability in the 'view_booking_summary_in_lightbox' function. Missing validation on a user-controlled key lets an unauthenticated user request booking summaries and obtain sensitive data such as customer names and email addresses. This weakness is classified as CWE-639, reflecting an authorization failure that allows data exposure.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker sending a crafted HTTP request that includes the unvalidated key to the 'view_booking_summary_in_lightbox' endpoint, which can be performed without authentication."}}}}, "created": "2026-04-21T21:00:36.000369+00:00", "updated": "2026-04-21T21:00:36.000387+00:00", "vendors": []}