Privilege Escalation Vulnerability in LatePoint Calendar Booking Plugin for WordPress

CVE-2026-13228

What is CVE-2026-13228?

The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is susceptible to a Privilege Escalation due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function. Authenticated agents can supply arbitrary customer IDs, enabling them to alter the email field of any LatePoint customer, including those linked to WordPress Administrator accounts. This flaw arises from inadequate role verification, allowing unauthorized elevation of privileges for agents with sufficient access levels.

References