CVE-2024-8911
Published: 08 October 2024
Summary
CVE-2024-8911 is a critical-severity SQL Injection (CWE-89) vulnerability in Latepoint Latepoint. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The LatePoint plugin for WordPress is vulnerable to arbitrary user password changes via SQL injection (CWE-89) in versions up to and including 5.0.11. The flaw stems from insufficient escaping of a user-supplied parameter and inadequate preparation of the SQL query, enabling direct modification of stored passwords. The issue carries a CVSS 3.1 score of 9.8 and affects the plugin's customer or WordPress user authentication flows depending on configuration.
Unauthenticated remote attackers can exploit the vulnerability over the network to alter passwords and potentially seize control of administrator accounts. By default the "Use WordPress users as customers" setting is disabled, limiting impact to passwords stored in the plugin's separate customer table; when the setting is enabled, WordPress user passwords become modifiable as well.
The official changelog at wpdocs.latepoint.com and the Wordfence threat intelligence entry both document the issue and point to remediation steps. The EPSS score has remained flat at its peak value of 0.3092 since disclosure, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49475
Vulnerability details
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
more
existing SQL query. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note that changing a WordPress user's password is only possible if the "Use WordPress users as customers" setting is enabled, which is disabled by default. Without this setting enabled, only the passwords of plugin customers, which are stored and managed in a separate database table, can be modified.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.