CVE-2026-1566:

Privilege escalation vulnerability in LatePoint WordPress plugin allows authenticated users to gain elevated access.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Mar 3, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:12%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Privilege escalation vulnerability in LatePoint WordPress plugin allows authenticated users to gain elevated access.

Overview

This vulnerability (CVE-2026-1566) affects the LatePoint plugin for WordPress, a popular tool for managing appointments and events. The issue stems from inadequate access controls when creating new customer accounts. Authenticated users with Agent-level permissions can manipulate the 'wordpress_user_id' field to link a customer account to any existing WordPress user, including administrators. Subsequently, they can initiate a password reset for this linked account, effectively elevating their privileges to the highest level of access within the WordPress installation. The vulnerability has been assigned a CVSS v3.1 base score of 8.8, indicating a high severity level. The attack vector is network-based, requires low attack complexity, and can be executed without user interaction, making it a significant threat to affected WordPress installations.

Remediation

To mitigate this vulnerability, website administrators should immediately update the LatePoint plugin to the latest version available after 5.2.7. If an update is not yet available, it is recommended to temporarily disable the plugin until a patched version is released. Additionally, implementing the principle of least privilege for user roles and regularly auditing user permissions can help minimize the potential impact of such vulnerabilities. Website owners should also consider implementing additional security measures such as two-factor authentication and regular security audits to enhance overall WordPress security.