LatePoint WordPress Plugin EUVD-2026-96090

Exploitation requires an authenticated attacker holding a LatePoint role (agent or custom role) that a WordPress administrator has explicitly granted the settings__edit capability - this is a non-default delegation, not available to ordinary customers or unauthenticated users. A second prerequisite is that a new LatePoint customer account is self-registered AFTER the malicious default_wp_role_for_customer value is persisted; the privilege escalation only materializes on that subsequent registration (which the attacker can self-trigger if public customer registration is enabled). Limiting factors: the required capability grant is operator-controlled and non-default, and the server performs no role allowlist validation (the restriction exists only in the UI dropdown), so environments that never delegate settings__edit to lower-trust roles are not exposed.

This is a genuine high-impact privilege-escalation flaw (CWE-269) but with meaningful real-world gating, so it sits below its 8.8 headline score in practical priority. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) models full confidentiality/integrity/availability loss via WordPress administrator takeover, which is accurate for the outcome, but the AC:L rating understates the compound preconditions the description spells out: a WordPress administrator must first have granted the non-default settings__edit capability to a LatePoint agent or custom role, AND a new LatePoint customer must self-register after the malicious change - I assess this as AC:H. Exploitation status is 'no public exploit identified at time of analysis': the record carries no KEV listing, no POC flag, and no EPSS score, so there is no evidence of active exploitation or published exploit code. PR:L in the vector confirms an authenticated attacker is required. No EPSS or KEV data is present to corroborate exploitation likelihood - treat likelihood as unquantified rather than low. Net: credible and serious where the prerequisite capability grant exists, but not a drop-everything internet-wide emergency given the privileged-insider precondition and absence of any exploitation signal.

An organization has delegated a LatePoint agent or custom role with the settings__edit capability to a semi-trusted staff member. That authenticated agent calls the settings update handler and overwrites default_wp_role_for_customer with administrator; the next person to self-register as a LatePoint customer (which the attacker can trigger themselves) is silently provisioned as a full WordPress administrator, handing the attacker complete site control. No public exploit code is identified at the time of analysis.