What the vulnerability does
01Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.
Explanation of Vulnerability in Simple Terms
02Summary
LatePoint versions up to 5.2.7 contain a privilege management flaw that allows authenticated users with low-level access to perform actions restricted to higher-privilege roles. An attacker with a standard user account can read, modify, or delete sensitive data and disrupt site operations. Update to a version newer than 5.2.7 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and disrupt operations normally restricted to administrators.
Potential impact on your site
04Site Impact
Unauthorized users can access and alter booking data, customer information, and site settings.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site.
Key dates
06Disclosure timeline
March 2, 2026
CVE published
April 8, 2026
Record updated
