CVE-2026-1566: LatePoint Plugin Privilege Escalation Flaw

CVE-2026-1566 Overview

A privilege escalation vulnerability has been identified in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. The vulnerability exists in all versions up to and including 5.2.7 and allows authenticated attackers with Agent-level access to escalate their privileges to administrator by exploiting improper handling of the wordpress_user_id field during customer creation.

Critical Impact

Authenticated attackers with minimal Agent-level privileges can gain full administrative access to WordPress installations by linking new customers to arbitrary user accounts, including administrators, and subsequently resetting their passwords.

Affected Products

• LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.2.7
• WordPress installations running vulnerable LatePoint plugin versions
• Sites utilizing the LatePoint Agent role functionality

Discovery Timeline

• 2026-03-03 - CVE-2026-1566 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-1566

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) stems from insufficient access control validation within the LatePoint plugin's customer creation workflow. The plugin fails to properly restrict which users can set the wordpress_user_id field when creating new customer records, allowing users with the LatePoint Agent role to associate customers with any WordPress user account, including administrator accounts.

The attack chain involves an authenticated user with Agent-level access creating a new customer and manipulating the wordpress_user_id parameter to link that customer to an administrator's account. Once this association is established, the attacker can trigger the password reset functionality for the customer, which effectively resets the password for the linked administrator account. This grants the attacker complete administrative control over the WordPress installation.

Root Cause

The root cause of this vulnerability is improper privilege management in the customer creation functionality. The plugin does not adequately validate whether the authenticated user has authorization to specify arbitrary wordpress_user_id values when creating customer records. Agent-level users should be restricted from linking customers to user accounts they do not control, particularly administrator accounts.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker must have valid credentials with at least Agent-level access to the LatePoint plugin. No user interaction is required from the victim administrator. The attacker exploits the vulnerability by:

1. Authenticating to WordPress with Agent-level LatePoint credentials
2. Navigating to the customer creation interface
3. Creating a new customer while setting the wordpress_user_id field to target an administrator's user ID
4. Triggering the password reset functionality for the newly created customer
5. Using the password reset to gain control of the administrator account

The vulnerability manifests in the customer creation handler where the wordpress_user_id field is accepted without proper authorization checks. Technical details and the specific code changes can be found in the WordPress Changeset Update.

Detection Methods for CVE-2026-1566

Indicators of Compromise

• Unexpected customer records linked to administrator WordPress user IDs
• Password reset requests for administrator accounts that were not initiated by the legitimate user
• Unusual activity from LatePoint Agent accounts, particularly bulk customer creation
• Audit logs showing modifications to the wordpress_user_id field by non-administrator users

Detection Strategies

• Monitor WordPress database for customer records where wordpress_user_id references administrator accounts created by Agent-level users
• Implement logging for all customer creation events that include a wordpress_user_id parameter
• Review password reset email logs for administrator accounts and correlate with LatePoint customer creation timestamps
• Deploy web application firewall rules to flag requests modifying the wordpress_user_id field from non-administrator sessions

Monitoring Recommendations

• Enable comprehensive audit logging for the LatePoint plugin and WordPress user management functions
• Set up alerts for password reset requests targeting administrator accounts
• Monitor for newly created customer records with administrator-level wordpress_user_id associations
• Regularly review LatePoint Agent account activities and permissions

How to Mitigate CVE-2026-1566

Immediate Actions Required

• Update the LatePoint plugin to the latest patched version immediately
• Audit existing customer records for suspicious wordpress_user_id associations with administrator accounts
• Review all LatePoint Agent accounts and revoke unnecessary privileges
• Reset passwords for all administrator accounts as a precautionary measure
• Check WordPress audit logs for signs of exploitation

Patch Information

The vulnerability has been addressed in plugin versions released after 5.2.7. The security fix implements proper authorization checks to prevent Agent-level users from setting arbitrary wordpress_user_id values during customer creation. Detailed information about the patch is available in the WordPress Changeset Update. Additional vulnerability analysis is provided in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the LatePoint plugin until the update can be applied
• Remove Agent-level access from untrusted users until patched
• Implement database-level triggers to prevent modification of wordpress_user_id by non-administrators
• Use a web application firewall to block requests containing the wordpress_user_id parameter from non-administrator sessions

# Example: Query to identify potentially compromised customer records
# Run this against your WordPress database to find suspicious associations
wp db query "SELECT c.*, u.user_login FROM wp_latepoint_customers c 
JOIN wp_users u ON c.wordpress_user_id = u.ID 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%'"