LatePoint EUVD-2026-25910

The attacker must be authenticated and hold the LatePoint latepoint_agent role, which by default grants the customer__edit capability required to call the connect-customer-to-wp-user ability - this is the exact gating prerequisite and is not a default WordPress role. Given that role, exploitation is remote, low-complexity, and needs no victim interaction. What limits it: the target account takeover works by relinking a LatePoint customer to a privileged WordPress user ID and then driving the plugin's normal customer password-reset flow, so the site must have LatePoint installed at ≤5.4.1 with agent accounts provisioned and the customer password-reset functionality operative; sites that never grant the agent role to untrusted users are not practically exposed.

Signals are mixed but lean toward 'patch promptly, not an emergency.' The CVSS 8.8 and 'Technical Impact: total' SSVC rating reflect the genuine end-state (full admin takeover). However AV:N/AC:L/PR:L/UI:N shows a real gatekeeper: the attacker must already hold the latepoint_agent role, which is not a default WordPress role and is typically assigned only to trusted staff, so this is largely an insider/compromised-staff-account escalation rather than an anonymous internet threat. Corroborating this, EPSS is only 0.05% (15th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and there is no public exploit identified at time of analysis and no CISA KEV listing. The low EPSS is consistent with the PR:L prerequisite rather than contradicting the high CVSS. Net: a real, high-impact privilege-escalation bug worth patching quickly on any site that provisions LatePoint agents, but not a mass-exploitation, wormable issue.

A booking-desk employee (or an attacker who has phished/compromised such a staff login) is given the standard LatePoint agent role. They invoke the connect-customer-to-wp-user ability to link a customer record they control to the site administrator's WordPress user ID, then use LatePoint's customer password-reset flow to receive/reset the admin's credentials and log in as administrator. No public exploit is identified at time of analysis, and the low-complexity, no-user-interaction path (AV:N/AC:L/UI:N) means an agent-level account is the only real barrier.