CVE-2026-6741
Deferred Deferred - Pending Action
Privilege Escalation in LatePoint Plugin Enables Full Site Takeover

Publication date: 2026-04-27

Last updated on: 2026-04-27

Assigner: Wordfence

Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-27
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-6741
EUVD
EUVD-2026-25910
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
latepoint calendar_booking_plugin to 5.4.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The LatePoint – Calendar Booking Plugin for WordPress has a vulnerability in versions up to 5.4.1 that allows privilege escalation. This happens because the plugin's execute() method for the connect-customer-to-wp-user ability does not properly check authorization. It only requires the customer__edit capability, which is granted to the latepoint_agent role by default, but it does not verify if the targeted WordPress user ID belongs to a privileged account.

As a result, an authenticated attacker with the latepoint_agent role can link any LatePoint customer record to an administrator's WordPress account. This linkage allows the attacker to reset the administrator's password through the normal customer password-reset process, potentially leading to a full site takeover.

Impact Analysis

This vulnerability can have severe impacts including full site takeover. An attacker with the latepoint_agent role can escalate their privileges by linking a customer record to an administrator account and resetting the administrator's password. This compromises the administrator's account, giving the attacker complete control over the WordPress site.

  • Loss of administrative control over the website.
  • Potential unauthorized access to sensitive data.
  • Ability to modify site content, settings, or install malicious code.
  • Disruption of normal business operations due to site compromise.
Compliance Impact

The vulnerability allows an authenticated attacker with the latepoint_agent role to escalate privileges and take over an administrator's account by linking a customer record to the admin account and resetting the password. This full site takeover risk can lead to unauthorized access to sensitive data and administrative functions.

Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart