CVE-2026-1566 - Vulnerability Analysis

Overview

LatePoint Calendar Booking Plugin for WordPress <= 5.2.7 contains a privilege escalation caused by improper handling of 'wordpress_user_id' field by users with Agent role, letting authenticated attackers with Agent-level access escalate privileges via password reset.

Severity & Score

Impact

Authenticated attackers with Agent-level access can escalate privileges to administrator by linking customers to arbitrary user IDs and resetting passwords.

Mitigation

Update to the latest version beyond 5.2.7.

References

• https://plugins.trac.wordpress.org/changeset/3463945/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner