CVE-2026-8176: LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPressfrom your environment.Uninstall the LatePoint plugin if it is not required, or remove it from affected systems until an official patch/fix is available.
- Configuration
Disable the unauthenticated customer-cabinet password reset feature in LatePoint plugin settings until a patch is available.
LatePoint Customer-Cabinet customer-cabinet password reset = disabled - Compensating control
Restrict or remove Agent (Agent+) accounts and privileges: limit the Agent role to trusted personnel only, temporarily revoke Agent access where possible, and restrict access to management/Agent APIs via network controls (firewall, IP allowlist) until the vulnerability is addressed.
- Operational
Rotate WordPress Administrator credentials and audit administrator accounts and logs for unauthorized changes; if an administrative account was overwritten or suspected compromised, restore a known-good admin account and credentials after investigation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8176?
CVE-2026-8176 has a high severity rating of 7.5.
How do I fix CVE-2026-8176?
To fix CVE-2026-8176, update the LatePoint plugin to the latest version beyond 5.5.1.
Who is affected by CVE-2026-8176?
Authenticated users with Agent+ privileges in LatePoint up to version 5.5.1 are affected by CVE-2026-8176.
What type of vulnerability is CVE-2026-8176?
CVE-2026-8176 is a privilege escalation vulnerability allowing an authenticated Agent+ to gain Administrator access.
What can an attacker do with CVE-2026-8176?
An attacker can exploit CVE-2026-8176 to escalate their privileges and gain Administrator rights in LatePoint.