What is the CVSS score of CVE-2026-6741?

CVE-2026-6741 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of LatePoint are affected by CVE-2026-6741?

The LatePoint WordPress booking plugin (versions 5.4.1 and earlier) contains a privilege escalation vulnerability enabling authenticated agent-level users to hijack administrator accounts and achieve…

How to fix or mitigate CVE-2026-6741?

Within 24 hours: Inventory all WordPress installations running LatePoint ≤5.4.1 and identify which agents have access to customer management features. Within 7 days: Restrict latepoint_agent role to essential trusted personnel only, implement enhanced monitoring of administrator password resets and account modifications, and contact LatePoint support to confirm patch timeline and availability. Within 30 days: Deploy a patched version of LatePoint if released by the vendor, or migrate to an alternative WordPress booking solution if no patch is forthcoming.

LatePoint CVE-2026-6741

EUVD-2026-25910 HIGH

Improper Privilege Management (CWE-269)

2026-04-27 Wordfence

WordPress Privilege Escalation Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote and low-complexity, but requires the pre-provisioned latepoint_agent role so PR:L; missing authorization check yields full admin takeover, giving C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:01 vuln.today

EUVD ID Assigned

Apr 27, 2026 - 20:00 euvd

EUVD-2026-25910

CVE Published

Apr 27, 2026 - 19:36 nvd

HIGH 8.8

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.

AnalysisAI

Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding the built-in latepoint_agent role hijack any WordPress administrator account. The connect-customer-to-wp-user ability's execute() method performs no check that the target WP user ID is a privileged account, so an agent can bind a controlled LatePoint customer record to an admin's account and then trigger the standard customer password-reset flow to seize it. CVSS is 8.8; EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but the technical impact is total site takeover.

Technical ContextAI

LatePoint is a WordPress appointment/booking plugin that ships its own role model, including a latepoint_agent role and granular capabilities such as customer__edit. Internally it maps LatePoint 'customer' records to native WordPress users, and exposes 'abilities' (server-side action handlers) - here the connect-customer-to-wp-user ability implemented in lib/abilities/customers/connect-customer-to-wp-user.php. The root cause is CWE-269 (Improper Privilege Management): execute() gates the action only on the customer__edit capability (granted to agents by default per roles_helper.php) and never validates the privilege level of the WordPress user being linked (customer_model.php). Because the linkage is unchecked, a low-privileged agent can associate their customer record with any wp_users row, including an administrator, and then abuse LatePoint's own customer password-reset email flow to take control of that account.

RemediationAI

Upgrade LatePoint to a fixed release above 5.4.1; the upstream code change is visible in the WordPress plugin changeset https://plugins.trac.wordpress.org/changeset/3514330/latepoint, and site owners should update via the WordPress plugin updater to the latest available version (an exact vendor fix-version string is not stated in the provided data, so confirm the patched tag on the plugin page https://wordpress.org/plugins/latepoint/ before deploying). Until updated, restrict who holds the latepoint_agent role to fully trusted staff and audit existing agent accounts, since the exploit hinges on that role; as compensating controls, review the customer__edit capability assigned to latepoint_agent (revoking or tightening it via a roles plugin blocks the connect-customer-to-wp-user ability but will also break agents' legitimate customer-editing, so test workflows first), monitor for any LatePoint customer records newly linked to administrator WordPress users, and watch for unexpected admin password-reset emails. Also review whether an existing administrator account has been unexpectedly re-linked as a fallback detection step.