The LatePoint plugin for WordPress suffers from improper privilege management (CWE-269) due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability. The method only requires the customer__edit capability, which the latepoint_agent role has by default, but does not verify if the targeted WordPress user ID belongs to a privileged account. This allows an authenticated attacker with the latepoint_agent role to associate any LatePoint customer record with an administrator's WordPress account and reset the administrator's password, resulting in complete control over the site. The vulnerability affects versions up to and including 5.4.1 and has a CVSS 3.1 score of 8.8 (high severity). No official patch or remediation guidance is currently available.

Successful exploitation allows an authenticated attacker with the latepoint_agent role to escalate privileges by linking a customer record to an administrator account and resetting the administrator's password. This leads to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the latepoint_agent role to trusted users only. Monitor for suspicious activity involving customer-to-user linking and password resets. Avoid granting the latepoint_agent role to untrusted or low-privilege users to reduce risk.