CVE-2026-1566: LatePoint Plugin Privilege Escalation Flaw

CVE-2026-1566 Overview

A privilege escalation vulnerability has been identified in the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress. The vulnerability exists in all versions up to and including 5.2.7 and allows authenticated attackers with Agent-level access to escalate their privileges to administrator by exploiting improper handling of the wordpress_user_id field during customer creation.

Critical Impact
Authenticated attackers with minimal Agent-level privileges can gain full administrative access to WordPress installations by linking new customers to arbitrary user accounts, including administrators, and subsequently resetting their passwords.

Affected Products

LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.2.7
WordPress installations running vulnerable LatePoint plugin versions
Sites utilizing the LatePoint Agent role functionality

Discovery Timeline

2026-03-03 - CVE-2026-1566 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-1566

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) stems from insufficient access control validation within the LatePoint plugin's customer creation workflow. The plugin fails to properly restrict which users can set the wordpress_user_id field when creating new customer records, allowing users with the LatePoint Agent role to associate customers with any WordPress user account, including administrator accounts.

The attack chain involves an authenticated user with Agent-level access creating a new customer and manipulating the wordpress_user_id parameter to link that customer to an administrator's account. Once this association is established, the attacker can trigger the password reset functionality for the customer, which effectively resets the password for the linked administrator account. This grants the attacker complete administrative control over the WordPress installation.

Root Cause

The root cause of this vulnerability is improper privilege management in the customer creation functionality. The plugin does not adequately validate whether the authenticated user has authorization to specify arbitrary wordpress_user_id values when creating customer records. Agent-level users should be restricted from linking customers to user accounts they do not control, particularly administrator accounts.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker must have valid credentials with at least Agent-level access to the LatePoint plugin. No user interaction is required from the victim administrator. The attacker exploits the vulnerability by:

Authenticating to WordPress with Agent-level LatePoint credentials
Navigating to the customer creation interface
Creating a new customer while setting the wordpress_user_id field to target an administrator's user ID
Triggering the password reset functionality for the newly created customer
Using the password reset to gain control of the administrator account

The vulnerability manifests in the customer creation handler where the wordpress_user_id field is accepted without proper authorization checks. Technical details and the specific code changes can be found in the WordPress Changeset Update.

Detection Methods for CVE-2026-1566

Indicators of Compromise

Unexpected customer records linked to administrator WordPress user IDs
Password reset requests for administrator accounts that were not initiated by the legitimate user
Unusual activity from LatePoint Agent accounts, particularly bulk customer creation
Audit logs showing modifications to the wordpress_user_id field by non-administrator users

Detection Strategies

Monitor WordPress database for customer records where wordpress_user_id references administrator accounts created by Agent-level users
Implement logging for all customer creation events that include a wordpress_user_id parameter
Review password reset email logs for administrator accounts and correlate with LatePoint customer creation timestamps
Deploy web application firewall rules to flag requests modifying the wordpress_user_id field from non-administrator sessions

Monitoring Recommendations

Enable comprehensive audit logging for the LatePoint plugin and WordPress user management functions
Set up alerts for password reset requests targeting administrator accounts
Monitor for newly created customer records with administrator-level wordpress_user_id associations
Regularly review LatePoint Agent account activities and permissions

How to Mitigate CVE-2026-1566

Immediate Actions Required

Update the LatePoint plugin to the latest patched version immediately
Audit existing customer records for suspicious wordpress_user_id associations with administrator accounts
Review all LatePoint Agent accounts and revoke unnecessary privileges
Reset passwords for all administrator accounts as a precautionary measure
Check WordPress audit logs for signs of exploitation

Patch Information

The vulnerability has been addressed in plugin versions released after 5.2.7. The security fix implements proper authorization checks to prevent Agent-level users from setting arbitrary wordpress_user_id values during customer creation. Detailed information about the patch is available in the WordPress Changeset Update. Additional vulnerability analysis is provided in the Wordfence Vulnerability Report.

Workarounds

Temporarily disable the LatePoint plugin until the update can be applied
Remove Agent-level access from untrusted users until patched
Implement database-level triggers to prevent modification of wordpress_user_id by non-administrators
Use a web application firewall to block requests containing the wordpress_user_id parameter from non-administrator sessions

bash

# Example: Query to identify potentially compromised customer records
# Run this against your WordPress database to find suspicious associations
wp db query "SELECT c.*, u.user_login FROM wp_latepoint_customers c 
JOIN wp_users u ON c.wordpress_user_id = u.ID 
JOIN wp_usermeta m ON u.ID = m.user_id 
WHERE m.meta_key = 'wp_capabilities' 
AND m.meta_value LIKE '%administrator%'"