High severity · published Jun 16, 2026
CVE-2026-8176
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LatePoint – Calendar Booking Plugin for Appointments and Events · latepoint
through 5.5.1 · source: vendor
Affected product
LC
LatePoint – Calendar Booking Plugin for Appointments and Events
latepoint
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8176
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L415
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L491
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customers_controller.php#L342
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L253
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php#L322
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php#L415
More from LatePoint – Calendar Booking Plugin for Appointments and Events
8.8
CVE-2026-13228
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
8.8
CVE-2026-6741
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
8.8
CVE-2026-1566
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
8.8
CVE-2025-7052
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
8.2
CVE-2025-7038
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function