LatePoint CVE-2026-13228

The attacker must already hold an authenticated LatePoint Agent-level account (or a higher custom role) on the target WordPress site - this is the core prerequisite and main limiting factor, as the flaw is not anonymously exploitable. Given that, exploitation requires reaching the public-scope create_or_update() path of OsOrdersController and supplying an arbitrary order[customer_id] plus an attacker-controlled email; the targeted customer record must be linked to a WordPress user (ideally an Administrator) for the escalation to yield admin. No user interaction is needed (UI:N) and no non-default plugin configuration is required - the vulnerable code is present in stock LatePoint versions up to and including 5.6.3. What limits exploitation: the required Agent account, the presence of a WordPress-account-linked LatePoint customer for a privileged user, and the site running an unpatched version (<= 5.6.3).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) is internally consistent with the description: network-reachable, low complexity, no user interaction, and requiring only low privilege (an authenticated Agent account), yielding full C/I/A impact because the end state is WordPress Administrator. In SSVC terms, exploitation is currently POC-absent, technical impact is total (site takeover), and automatability is plausible since the request is deterministic and needs no victim interaction - but the hard gate is obtaining Agent-level access, which is not a default anonymous capability. No EPSS score or KEV entry was provided; absent those, real-world exploitation pressure is currently unquantified. This is a genuine high-priority issue for any site that grants LatePoint Agent accounts to semi-trusted staff, because such a user can silently become full admin; where Agent accounts are tightly held by trusted operators, practical exposure is lower. Net: high severity is justified, but the requirement of a pre-existing Agent account tempers it from 'internet-facing unauthenticated takeover' to 'authenticated low-trust-role escalation'.

An attacker who holds (or is granted) a low-privilege LatePoint Agent account sends a crafted create_or_update() request to OsOrdersController with order[customer_id] set to the customer record linked to a site Administrator and an email value they control. The plugin overwrites the Administrator-linked customer's email, and the attacker then triggers the customer login flow, where authorize_customer() logs them in as the Administrator without any role check - resulting in full site takeover. No public exploit code was identified at time of analysis, but the vulnerable functions and lines are precisely referenced in public plugin source.