CVE-2026-6741

Description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.

PUBLISHED Reserved 2026-04-21 | Published 2026-04-27 | Updated 2026-04-28 | Assigner Wordfence

Problem types

CWE-269 Improper Privilege Management

Product status

Timeline

Credits

Valase Paul finder

Chirita Catalin-Andrei finder

Ramon Mateas finder

References

www.wordfence.com/...-031e-4f4a-9126-dd3a37975246?source=cve

plugins.trac.wordpress.org/...onnect-customer-to-wp-user.php

plugins.trac.wordpress.org/.../lib/models/customer_model.php

plugins.trac.wordpress.org/...1/lib/helpers/roles_helper.php

wordpress.org/plugins/latepoint/

plugins.trac.wordpress.org/changeset/3514330/latepoint

cve.org (CVE-2026-6741)

nvd.nist.gov (CVE-2026-6741)

Download JSON