EUVD-2026-36879
GHSA-2prc-85pp-97r9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress contributor account
-
DeliveryAuthenticate to target site
-
ExploitSend crafted request to LatePoint role-handling endpoint
-
ExecutionTrigger incorrect privilege assignment
-
PersistGain elevated WordPress capabilities
-
ImpactInstall malicious plugin for full site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires an authenticated WordPress account at the Contributor role on a site where the LatePoint plugin (<= 5.5.1) is installed and active, and the attacker must reach the plugin's role-handling endpoint over the network. The CVSS AC:H signal indicates additional non-trivial conditions - likely a specific request sequence, timing, or parameter combination against the LatePoint role-assignment flow - rather than a single one-shot request. Exploitation is limited by the need for a valid contributor login (sites that disable open registration and vet contributors substantially reduce exposure) and by the plugin being active; no user interaction from an administrator is required (UI:N). |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable flaw requiring a low-privileged authenticated account and non-trivial conditions to exploit, yielding full CIA impact once successful - consistent with a contributor account escalating to a role that can edit content, install plugins, or take over the site. EPSS, KEV status, and SSVC decision data were not provided in the input, and no public exploit identified at time of analysis, so widespread opportunistic exploitation is not currently indicated. Practical risk concentrates on WordPress sites that allow open or weakly vetted contributor registration alongside LatePoint, where the PR:L barrier is effectively zero; for sites that tightly control contributor accounts, AC:H meaningfully limits realistic exploitation. Note that 'Contributor Privilege Escalation' in the description implies a contributor starting point, which aligns with PR:L in the vector. |
| Exploit ScenarioDerived | An attacker registers or compromises a Contributor-level account on a WordPress site running LatePoint 5.5.1 or earlier, then issues a crafted request to a LatePoint endpoint that mishandles role assignment, causing their account to be granted higher WordPress capabilities. With elevated privileges they install a malicious plugin or theme to achieve full site takeover; no public exploit identified at time of analysis, so weaponization currently requires independent research into the plugin's role-handling code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Privilege escalation in the LatePoint WordPress plugin versions 5.5.1 and earlier allows authenticated users holding low-privileged contributor accounts to elevate to higher-privileged roles, according to a Patchstack advisory. CVSS 3.1 scores this 7.5 (High) with full confidentiality, integrity, and availability impact, though high attack complexity and required low privileges constrain trivial exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Upstream fix availability is not explicitly confirmed in the provided data; administrators should upgrade LatePoint to a version newer than 5.5.1 once the vendor publishes one and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/latepoint/vulnerability/wordpress-latepoint-plugin-5-5-1-privilege-escalation-vulnerability for the patched release number. Until a fixed version is installed, restrict who can register or be assigned the WordPress Contributor role and audit existing contributor accounts for unexpected capability changes, accepting that this limits legitimate contributor-driven content workflows. As a stronger compensating control, deactivate the LatePoint plugin on sites that permit open contributor registration - this disables booking functionality but eliminates the escalation path - or place the wp-admin and LatePoint AJAX/REST endpoints behind IP allowlisting or a WAF rule that blocks role-assignment parameters from non-administrator sessions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LatePoint is a commercial WordPress appointment-booking and scheduling plugin that integrates with WordPress user roles to manage agents, customers, and bookings. The flaw is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns or accepts a privilege level higher than what the requesting WordPress user should be granted - typically caused by missing capability checks (current_user_can), trusting client-supplied role parameters, or improperly mapping booking/agent roles back to WordPress roles. Because LatePoint exposes booking workflows and agent management to lower-privileged users, an unsafe role assignment path lets a contributor-level account acquire capabilities normally reserved for editors or administrators within the WordPress site running the plugin.
Know when Latepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint (AV:N), contributor account required (PR:L), non-trivial exploitation conditions (AC:H), no admin interaction (UI:N), and full site takeover yields C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.
Executive ViewAI
A privilege escalation vulnerability in LatePoint WordPress plugin (versions 5.5.1 and earlier) enables any contributor-level user to escalate to administrative rights, creating an insider threat exposure for WordPress environments with multi-user teams. Organizations relying on this plugin for appointment or booking workflows face risk of unauthorized access to customer data, financial records, and site configuration. Immediate action is required to audit and restrict contributor access while awaiting vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable LatePoint plugin if business operations permit, (2) restrict contributor role to exclusively internal, fully-vetted staff members, (3) revoke all external consultant and contractor contributor access, (4) enable administrative logging and alerting for role elevation events, (5) enforce multi-factor authentication on all contributor-level and administrative accounts, (6) conduct monthly reviews of contributor account validity and role assignments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordP
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3)
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows
Exploit-DB