Privilege Escalation Vulnerability in LatePoint Calendar Booking Plugin for WordPress

CVE-2026-6741

What is CVE-2026-6741?

The LatePoint Calendar Booking Plugin for WordPress is susceptible to a privilege escalation issue due to inadequate authorization checks within the execute() method. Specifically, the vulnerability stems from the connect-customer-to-wp-user capability, which only requires the customer__edit permission assigned to the latepoint_agent role. This oversight does not validate if the targeted WordPress user ID corresponds to a privileged account. As a result, unauthorized actors with the latepoint_agent role may associate any LatePoint customer record with an administrator's account, facilitating password resets and potentially leading to complete control over the site.

References