EUVD-2026-37060
GHSA-2pxw-w9w5-c6hm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Agent-level LatePoint account
-
DeliveryIdentify Administrator-linked customer record
-
ExploitInvoke orders/customer-cabinet endpoints to reach update flow
-
ExecutionChain customer_model/customer_helper flaws to overwrite admin password
-
PersistAuthenticate as WordPress Administrator
-
ImpactInstall backdoor or pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold an authenticated LatePoint Agent role or higher on the target WordPress site (PR:L), the vulnerable LatePoint plugin must be installed and active at version ≤ 5.5.1, and at least one WordPress Administrator account must exist as a target for the password overwrite. Exploitation does not require user interaction (UI:N) and is network-reachable (AV:N) over the normal WordPress HTTP(S) interface, but the high attack complexity (AC:H) reflects that three independent flaws across the orders, customer cabinet and customer model code paths must be chained in the correct order rather than a single request. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) reflects a network-reachable but high-complexity attack that requires existing low-privilege (Agent) authentication and yields full C/I/A impact once an Administrator password is rewritten - effectively full site takeover. There is no EPSS or KEV data provided, and no public exploit identified at time of analysis, so this is currently a credible but not mass-exploited risk; AC:H plus PR:L means an attacker must already be a trusted insider/agent and chain three flaws, which limits opportunistic exploitation but is well within reach of a motivated attacker on multi-tenant booking sites. Prioritize accordingly: high impact, narrower attacker pool than a PR:N RCE. |
| Exploit ScenarioDerived | An attacker registers or compromises an Agent-tier LatePoint account on a target WordPress site, then issues a sequence of crafted requests through the customer cabinet and orders/customers controllers to drive the customer-update flow against a record linked to a WordPress Administrator. Because the password-change path does not re-check privilege of the target, the Administrator's password is silently overwritten, and the attacker logs in as Administrator to install backdoors or pivot. No public exploit identified at time of analysis, but the disclosure references exact line numbers of all three flaws. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows an authenticated user with Agent-level access or higher to chain three independent flaws and overwrite a WordPress Administrator's password without invoking any Administrator-only API. Wordfence-reported flaw with no public exploit identified at time of analysis, though source code locations of all three vulnerable code paths are referenced in the disclosure.
RemediationAI
No vendor-released patch identified at time of analysis - the input data references vulnerable code in the 5.5.1 tag and trunk but does not confirm a fixed release version, so administrators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a) and the LatePoint plugin page on WordPress.org for an update beyond 5.5.1 and upgrade as soon as one is published. As compensating controls, restrict who can hold the LatePoint Agent role to a minimum trusted set (every Agent account is now a potential Administrator), enforce strong unique passwords plus 2FA on all WordPress Administrator accounts so a password overwrite is detected via failed login notifications, and place the plugin behind a WAF (such as Wordfence) with a virtual patch rule for this advisory - trade-off is that disabling Agent registration or self-service may block legitimate booking workflows. If upgrade is impossible, temporarily deactivating the plugin eliminates the risk at the cost of removing booking functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LatePoint is a popular WordPress appointment/booking plugin (cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events) that implements its own role system layered on top of WordPress user accounts. The CWE-269 (Improper Privilege Management) root cause is that the plugin's orders_controller, customer_cabinet_controller, customer_model, customer_helper and customers_controller code paths (referenced lines in trunk/tags 5.5.1) allow an Agent-tier user to indirectly drive a customer/user update flow that ultimately resets the password of a linked WordPress Administrator account, because the password-change pathway does not re-validate that the target user's role exceeds the caller's privilege level. The exploit chains three weaknesses across these files rather than abusing a single function.
Know when Latepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoints (AV:N), requires authenticated Agent role (PR:L), chaining three flaws raises complexity (AC:H), and Administrator takeover yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
Executive ViewAI
LatePoint Calendar Booking, a WordPress plugin widely deployed for appointment scheduling, contains a privilege escalation vulnerability allowing Agent-level users (appointment coordinators, schedulers) to seize full administrative account control. With no vendor patch currently available, organizations cannot remediate through standard security updates and must take immediate containment action. This poses an urgent insider threat risk across all WordPress deployments relying on this plugin.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Agent-level account creation and assignment to only essential calendar coordination staff; (2) Implement real-time monitoring and alerting on WordPress administrator account changes; (3) Enforce principle of least privilege-Agent roles must not inherit capabilities beyond appointment scheduling; (4) Consider disabling the plugin entirely if alternative booking systems can be deployed; (5) Require regular audits of Agent account activity and access logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordP
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3)
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Unauthenticated information disclosure in the LatePoint appointment booking and scheduling plugin for WordPress (version
Exploit-DB