CVE-2026-6741
Privilege Escalation in LatePoint Plugin Enables Full Site Takeover
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| latepoint | calendar_booking_plugin | to 5.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated attacker with the latepoint_agent role to escalate privileges and take over an administrator's account by linking a customer record to the admin account and resetting the password. This full site takeover risk can lead to unauthorized access to sensitive data and administrative functions.
Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.
Can you explain this vulnerability to me?
The LatePoint – Calendar Booking Plugin for WordPress has a vulnerability in versions up to 5.4.1 that allows privilege escalation. This happens because the plugin's execute() method for the connect-customer-to-wp-user ability does not properly check authorization. It only requires the customer__edit capability, which is granted to the latepoint_agent role by default, but it does not verify if the targeted WordPress user ID belongs to a privileged account.
As a result, an authenticated attacker with the latepoint_agent role can link any LatePoint customer record to an administrator's WordPress account. This linkage allows the attacker to reset the administrator's password through the normal customer password-reset process, potentially leading to a full site takeover.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including full site takeover. An attacker with the latepoint_agent role can escalate their privileges by linking a customer record to an administrator account and resetting the administrator's password. This compromises the administrator's account, giving the attacker complete control over the WordPress site.
- Loss of administrative control over the website.
- Potential unauthorized access to sensitive data.
- Ability to modify site content, settings, or install malicious code.
- Disruption of normal business operations due to site compromise.