CVE-2025-14873

The LatePoint plugin for WordPress, used for scheduling appointments and events, has a security weakness in its routing system that affects all versions up to 5.2.5. Specifically, the 'call_by_route_name' function doesn't properly check whether a request is legitimate or not, allowing an attacker to execute administrative tasks without needing authentication. This vulnerability can be exploited if a site administrator clicks on a malicious link, enabling the attacker to carry out multiple unauthorized actions.

Based on public CVE data (MITRE/NVD).