CVE-2026-8176: CWE-269 Improper Privilege Management in latepoint LatePoint – Calendar Booking Plugin for Appointments and Events
LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.5.1 contain a privilege escalation vulnerability. Authenticated users with Agent-level access can chain three independent flaws to overwrite an Administrator's password without accessing Administrator-only APIs. This allows attackers to elevate their privileges to Administrator. The vulnerability is tracked as CVE-2026-8176 and has a high severity rating with a CVSS score of 7.5.
AI Analysis
Technical Summary
CVE-2026-8176 is a privilege escalation vulnerability in the LatePoint WordPress plugin for calendar booking. It affects versions up to 5.5.1 and involves chaining three separate flaws that enable an authenticated Agent user to overwrite the password of a WordPress Administrator account without invoking Administrator-only APIs. This improper privilege management (CWE-269) allows attackers with Agent access to escalate their privileges to Administrator, potentially gaining full control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with authenticated Agent-level access can escalate privileges to Administrator by overwriting the Administrator password. This compromises the confidentiality, integrity, and availability of the affected WordPress site, allowing full administrative control.
Mitigation Recommendations
A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to a version later than 5.5.1 or that the vulnerability has been otherwise mitigated by the vendor. Patch status is confirmed as available; apply the official fix promptly to prevent exploitation.
CVE-2026-8176: CWE-269 Improper Privilege Management in latepoint LatePoint – Calendar Booking Plugin for Appointments and Events
Description
LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.5.1 contain a privilege escalation vulnerability. Authenticated users with Agent-level access can chain three independent flaws to overwrite an Administrator's password without accessing Administrator-only APIs. This allows attackers to elevate their privileges to Administrator. The vulnerability is tracked as CVE-2026-8176 and has a high severity rating with a CVSS score of 7.5.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8176 is a privilege escalation vulnerability in the LatePoint WordPress plugin for calendar booking. It affects versions up to 5.5.1 and involves chaining three separate flaws that enable an authenticated Agent user to overwrite the password of a WordPress Administrator account without invoking Administrator-only APIs. This improper privilege management (CWE-269) allows attackers with Agent access to escalate their privileges to Administrator, potentially gaining full control over the WordPress site. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with authenticated Agent-level access can escalate privileges to Administrator by overwriting the Administrator password. This compromises the confidentiality, integrity, and availability of the affected WordPress site, allowing full administrative control.
Mitigation Recommendations
A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to a version later than 5.5.1 or that the vulnerability has been otherwise mitigated by the vendor. Patch status is confirmed as available; apply the official fix promptly to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-08T15:11:03.312Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a31650f0b89be6888c920ee
Added to database: 06/16/2026, 15:00:31 UTC
Last enriched: 06/23/2026, 15:35:15 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 100
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.