PT-2026-35519 · WordPress · Latepoint

Chirita Catalin-Andrei + 2 · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-6741

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.2

Description A privilege escalation issue exists due to a missing authorization check in the execute() function of the connect-customer-to-wp-user ability. The system only requires the customer edit capability, which is granted to the latepoint agent role by default, but fails to verify if the target WordPress user ID belongs to a privileged account. This allows authenticated attackers with the latepoint agent role to link a LatePoint customer record to an administrator account and reset the administrator's password through the standard customer password-reset process, leading to a full site takeover.

Recommendations Update the plugin to a version later than 5.4.1.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-6741

Affected Products

Latepoint

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-6741 · Security Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/models/customer_model.php · Note
• https://twitter.com/KaitanSecurity/status/2048862262920679491 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/71e99412-031e-4f4a-9126-dd3a37975246?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2048919479615099275 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/abilities/customers/connect-customer-to-wp-user.php · Note
• https://t.me/CVEtracker/51988 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3514330/latepoint · Note
• https://wordpress.org/plugins/latepoint · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/helpers/roles_helper.php · Note