CVE-2025-14873: 
WordPress vulnerability analysis and mitigation

CVE-2025-14873 is a Cross-Site Request Forgery (CSRF) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. It affects all versions up to and including 5.2.5, where the call_by_route_name function in the routing layer validates user capabilities but fails to enforce nonce verification. This flaw allows unauthenticated attackers to perform multiple administrative actions via forged requests if they can trick a site administrator into clicking a malicious link. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), stemming from the plugin's call_by_route_name routing function checking user capabilities but omitting WordPress nonce verification — a standard anti-CSRF mechanism. Because nonces are not validated, an attacker can craft a malicious HTTP request that, when triggered by an authenticated administrator's browser session, executes privileged administrative actions on the WordPress site. The attack vector is network-based, requires no privileges, but does require user interaction (social engineering the administrator). No public PoC code has been identified at this time (Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to perform unauthorized administrative actions within the LatePoint plugin on behalf of a tricked administrator, resulting in a low integrity impact. Confidentiality and availability are not directly affected according to the CVSS assessment. Depending on the administrative actions exposed through the vulnerable routing layer, an attacker could manipulate booking data, plugin settings, or other appointment/event management configurations (Red Hat CVE).

There is no evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time. The EPSS score is approximately 0.023%, indicating a low probability of exploitation in the near term. Exploitation requires social engineering an administrator, which raises the bar compared to fully unauthenticated attacks (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin version 5.2.5 or earlier using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Identify vulnerable administrative routes: Review the plugin's routing layer to enumerate administrative actions accessible via call_by_route_name that lack nonce verification.
3. Craft malicious request: Construct a forged HTTP request (e.g., an HTML form or image tag with auto-submit) targeting a privileged LatePoint administrative endpoint, embedding desired parameters (e.g., modifying settings or booking data).
4. Social engineer the administrator: Deliver the malicious payload to a logged-in site administrator via phishing email, forum post, or other means, causing their browser to automatically submit the forged request.
5. Administrative action executed: The administrator's authenticated session processes the forged request, performing the attacker's chosen administrative action without the administrator's knowledge (Red Hat CVE).

• Logs: WordPress access logs showing unexpected POST requests to LatePoint plugin administrative endpoints from unusual referrers or with no valid nonce parameters.
• Application: Unexplained changes to LatePoint plugin settings, booking records, or event configurations without corresponding administrator activity.
• Network: Requests to LatePoint admin routes originating from external or unexpected IP addresses correlated with administrator session activity.

WordPress site administrators should update the LatePoint plugin to a version beyond 5.2.5 that includes proper nonce verification in the call_by_route_name routing function. Until a patched version is available or applied, administrators should exercise caution with unsolicited links and emails, and consider temporarily deactivating the plugin if the risk is deemed unacceptable. Enabling a Web Application Firewall (WAF) with CSRF protection rules can provide an additional layer of defense (Red Hat CVE).