by Kastro
Paper/Archive/CVE-2025-6715

CVE-2025-6715

Unknown LatePoint — Latepoint < 5.1.94 - Unauthenticated LFI

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.1.471 × 209.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.

Affected

ProductAffectedFixed inSource
LatePoint< 5.1.945.1.94CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/357aba51-b65e-4691-864b-fef1c78a9362