Executive Summary

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress has a vulnerability that allows privilege escalation to Administrator. This affects versions up to and including 5.5.1. The vulnerability involves chaining three independent flaws that enable an authenticated user with Agent-level access or higher to overwrite a WordPress Administrator's password without needing to use any Administrator-only API.

As a result, an attacker who has Agent access can elevate their privileges to Administrator, gaining full control over the WordPress site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact because it allows an attacker with relatively low-level access (Agent+) to gain full Administrator privileges on a WordPress site.

• The attacker can overwrite the Administrator's password, effectively taking over the site.
• With Administrator access, the attacker can modify site content, install malicious plugins or themes, steal sensitive data, or disrupt site operations.
• This can lead to data breaches, loss of site integrity, and potential damage to the organization's reputation.

Useful 0 Not Useful 0