What the vulnerability does
01Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
Explanation of Vulnerability in Simple Terms
02Summary
LatePoint versions up to 5.5.1 contain a privilege management flaw that allows authenticated users with low-level access to perform actions restricted to higher-privilege roles. An attacker with a standard user account can read, modify, or delete sensitive booking and calendar data without proper authorization checks. This affects confidentiality, integrity, and availability of appointment information.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete booking and calendar data beyond their assigned permission level.
Potential impact on your site
04Site Impact
Unauthorized users can access or alter client bookings, appointments, and calendar settings, compromising data integrity and customer trust.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
June 16, 2026
CVE published
