The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all… (CVE-2026-104766)

CVE-2026-104766 describes a privilege escalation vulnerability in the LatePoint WordPress plugin (versions up to 5.7.3). The 'OsSettingsController::update()' method processes attacker-supplied 'settings' parameters without an allowlist, and 'OsSettingsHelper::prepare_value()' does not validate roles server-side before saving the 'default_wp_role_for_customer' setting. This allows an authenticated user with the 'settings__edit' capability (e.g., an agent or custom role) to change the default role assigned to new customers to 'administrator'. Consequently, any new customer account created after this change will have full WordPress administrator privileges. Exploitation depends on prior capability assignment by a WordPress administrator and subsequent customer registration.

An attacker with the 'settings__edit' capability can escalate privileges by modifying the default WordPress role for new customers to 'administrator'. This results in any new customer account being created with full administrative rights, potentially compromising the entire WordPress site. The vulnerability impacts confidentiality, integrity, and availability (CVSS 8.8).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid granting the 'settings__edit' capability to LatePoint agents or custom roles. Monitoring and restricting role assignments within the plugin settings can help mitigate exploitation risk.