Input validation vulnerability in LatePoint – Calendar Booking Plugin for Appointments and Events 5.1.94

The LatePoint plugin for WordPress has a security issue that allows attackers to manipulate a user’s account without proper authorization. This vulnerability is present in all versions up to 5.1.94. The problem lies in the change password function, where the plugin does not check for a unique code or user permission before resetting the password. This means that someone who is not logged in can trick a customer or administrator into clicking a harmful link, giving them control of the account.