What is the CVSS score of CVE-2026-8176?

CVE-2026-8176 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of LatePoint Plugin are affected by CVE-2026-8176?

LatePoint Calendar Booking, a WordPress plugin widely deployed for appointment scheduling, contains a privilege escalation vulnerability allowing Agent-level users (appointment coordinators,…

How to fix or mitigate CVE-2026-8176?

Within 24 hours: Identify all WordPress installations running LatePoint ≤5.5.1; audit current Agent-level account assignments; restrict creation of new Agent accounts pending resolution. Within 7 days: Disable LatePoint Calendar Booking or migrate to an alternative booking solution; reduce Agent-level account count to minimum necessary staff. Within 30 days: Monitor Wordfence and plugin vendor advisories for security patches; apply patches immediately upon availability; if patch unavailable within 30 days, implement permanent alternative to the plugin.

LatePoint Plugin CVE-2026-8176

EUVD-2026-37060 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 Wordfence

GHSA-2pxw-w9w5-c6hm

WordPress Privilege Escalation Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (Wordfence) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable WordPress endpoints (AV:N), requires authenticated Agent role (PR:L), chaining three flaws raises complexity (AC:H), and Administrator takeover yields full C/I/A impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 10:20 vuln.today

CVE Published

Jun 16, 2026 - 09:31 cve.org

HIGH 7.5

DescriptionNVD

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.

AnalysisAI

Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows an authenticated user with Agent-level access or higher to chain three independent flaws and overwrite a WordPress Administrator's password without invoking any Administrator-only API. Wordfence-reported flaw with no public exploit identified at time of analysis, though source code locations of all three vulnerable code paths are referenced in the disclosure.

Technical ContextAI

LatePoint is a popular WordPress appointment/booking plugin (cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events) that implements its own role system layered on top of WordPress user accounts. The CWE-269 (Improper Privilege Management) root cause is that the plugin's orders_controller, customer_cabinet_controller, customer_model, customer_helper and customers_controller code paths (referenced lines in trunk/tags 5.5.1) allow an Agent-tier user to indirectly drive a customer/user update flow that ultimately resets the password of a linked WordPress Administrator account, because the password-change pathway does not re-validate that the target user's role exceeds the caller's privilege level. The exploit chains three weaknesses across these files rather than abusing a single function.

RemediationAI

No vendor-released patch identified at time of analysis - the input data references vulnerable code in the 5.5.1 tag and trunk but does not confirm a fixed release version, so administrators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a) and the LatePoint plugin page on WordPress.org for an update beyond 5.5.1 and upgrade as soon as one is published. As compensating controls, restrict who can hold the LatePoint Agent role to a minimum trusted set (every Agent account is now a potential Administrator), enforce strong unique passwords plus 2FA on all WordPress Administrator accounts so a password overwrite is detected via failed login notifications, and place the plugin behind a WAF (such as Wordfence) with a virtual patch rule for this advisory - trade-off is that disabling Agent registration or self-service may block legitimate booking workflows. If upgrade is impossible, temporarily deactivating the plugin eliminates the risk at the cost of removing booking functionality.