The LatePoint plugin for WordPress suffers from improper privilege management (CWE-269) due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability. The method only requires the customer__edit capability assigned to the latepoint_agent role by default, without verifying if the targeted WordPress user ID belongs to a privileged account. This allows an authenticated attacker with the latepoint_agent role to associate any LatePoint customer record with an administrator's WordPress user account and reset the administrator's password through the standard customer password-reset process, resulting in complete control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity.

Successful exploitation allows an attacker with the latepoint_agent role to escalate privileges by linking a customer record to an administrator account and resetting the administrator's password. This leads to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict assignment of the latepoint_agent role to trusted users only and monitor for suspicious activity related to customer-to-user linking and password resets.