CVE-2024-2472: Unauthorized Access in LatePoint WordPress Plugin. This vulnerability allows unauthenticated attackers to access and modify data because of a missing capability check in the 'start_or_use_session_for_customer' function, affecting versions up to 4.9.9. Attackers can view customer cabinets, including Personally Identifiable Information (PII) like email addresses, and change LatePoint user passwords. Although the SVRS is 30, indicating a lower immediate risk compared to critical vulnerabilities, the potential for PII exposure necessitates careful monitoring and patching. The vulnerability stems from CWE-639, an authorization bypass, highlighting the importance of proper access controls. Addressing this is crucial to prevent data breaches and maintain user trust, especially given the plugin's popularity. While not critical, the risk of exploitation is present.