CVE-2026-104766: CWE-269 Improper Privilege Management in latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVE-2026-104766 describes a privilege escalation vulnerability in the LatePoint Appointment Booking Plugin for WordPress versions up to 5.7.3. The vulnerability arises from the OsSettingsController::update() handler processing attacker-controlled 'settings' parameters without an allowlist, combined with OsSettingsHelper::prepare_value() lacking server-side role validation. This allows authenticated users with the 'settings__edit' capability (e.g., agents or custom roles) to overwrite the 'default_wp_role_for_customer' setting to 'administrator'. Consequently, any new customer account registered via LatePoint after this change inherits full WordPress administrator privileges. Exploitation depends on a WordPress administrator having granted the 'settings__edit' capability to a non-administrator LatePoint role.

Successful exploitation allows an authenticated LatePoint user with 'settings__edit' capability to escalate privileges by causing new customer accounts to be created with WordPress administrator rights. This grants full control over the WordPress site to those new accounts, potentially leading to complete site compromise. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress installation.

No explicit patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, WordPress administrators should avoid granting the 'settings__edit' capability to non-administrator LatePoint roles. Monitoring and restricting role assignments can mitigate exploitation risk.