LatePoint Appointment Booking Plugin: Privilege escalation to WordPress administrator
Summary
The LatePoint Appointment Booking Plugin for WordPress up to and including 5.7.3 does not restrict which values can be set for the default WordPress role of new customers. An authenticated user with a LatePoint role that has the settings__edit capability can set this role to administrator. Any customer account that is then self-registered through LatePoint receives full WordPress administrator rights, which allows complete takeover of the website. Exploitation requires that an administrator has granted settings__edit to a LatePoint role and that a new customer registers afterwards.
Affected
- LatePoint Appointment Booking Plugin (Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress) up to and including 5.7.3
- Default configuration: not affected
Fixed in
Unknown. The vendor has not confirmed the first fixed version. Update to the latest available LatePoint release (5.7.6 at the time of research) and verify the version.
Workaround
- Remove the settings__edit capability from all LatePoint agent and custom roles that do not need it.
- Check that the default WordPress role for LatePoint customers is not set to administrator.
- Review recently created WordPress administrator accounts, especially those created through LatePoint registrations.
Exploitation
- No public proof of concept or exploit found.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS: 0.00293.
Our recommendation
- Update LatePoint to the latest version and verify the installed version.
- Apply the workarounds until the update is installed.
- Restrict the settings__edit capability to trusted administrators only.
- Check WordPress user accounts for unexpected administrators and remove any that are not known.
- Monitor new customer registrations and administrator role changes.
- Priority is high for sites with multiple LatePoint staff roles or public customer registration, and medium for single-administrator sites without custom roles.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Vulnerable code: settings_controller.php (tag 5.7.3) plugins.trac.wordpress.org
- Vulnerable code: settings_helper.php (tag 5.7.3) plugins.trac.wordpress.org
- CVE details (OpenCVE) app.opencve.io
- Rapid7 / Vulners record vulners.com
- LatePoint changelog latepoint.com
- WordPress plugin directory: LatePoint wordpress.org
- Patchstack LatePoint vulnerability history patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:47.
Original description (NVD)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint
- https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.