CVE-2025-7038
Published: 30 September 2025
Summary
CVE-2025-7038 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-7038 is an authentication bypass vulnerability (CWE-288) in the LatePoint plugin for WordPress, affecting all versions up to and including 5.1.94. The issue stems from insufficient identity verification in the steps__load_step route of the latepoint_route_call AJAX endpoint. This endpoint processes client-supplied customer email and related fields before invoking the internal login handler, without checking the user's login status, required capabilities, or a valid AJAX nonce.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, score 8.2). By supplying arbitrary customer details, they can log into any customer's account, potentially accessing sensitive information with high confidentiality impact and limited integrity impact.
Advisories referenced in Wordfence threat intelligence and WordPress plugin trac repositories highlight the vulnerable code in tags like 5.1.93, including files such as latepoint.php and steps_controller.php, along with changeset 3366851 addressing the endpoint logic. Mitigation requires updating the LatePoint plugin to a version beyond 5.1.94, with developer resources available on the plugin page.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31703
Vulnerability details
The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and…
more
related customer fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This makes it possible for unauthenticated attackers to log into any customer’s account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct authentication bypass in publicly exposed WordPress plugin AJAX endpoint enables remote unauthenticated account access, mapping cleanly to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved access authorizations and restrictions, directly preventing unauthenticated attackers from bypassing login status and capability checks to access customer accounts via the vulnerable AJAX endpoint.
IA-2 requires identification and authentication of users prior to logical access, countering the vulnerability's failure to verify user login status before invoking the internal login handler.
IA-5 ensures proper management and verification of authenticators such as AJAX nonces, mitigating the lack of nonce validation that enables the authentication bypass with client-supplied fields.