CVE-2026-1566

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1566", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-28T20:18:56.426Z", "datePublished": "2026-03-02T23:22:55.673Z", "dateUpdated": "2026-04-08T17:21:48.917Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:48.917Z"}, "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password."}], "title": "LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463945/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Hung Nguyen"}], "timeline": [{"time": "2026-01-23T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-28T20:52:12.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-02T11:03:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T01:52:05.848759Z", "id": "CVE-2026-1566", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T01:52:20.828Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1566", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T01:52:05.848759Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T01:52:16.812Z"}}], "cna": {"title": "LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Hung Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-23T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-28T20:52:12.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-02T11:03:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3463945/"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:48.917Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1566", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:48.917Z", "dateReserved": "2026-01-28T20:18:56.426Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-02T23:22:55.673Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "vendor": "latepoint", "versions": [{"lessThanOrEqual": "5.2.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password."}, {"lang": "es", "value": "El plugin LatePoint \u2013 Calendar Booking Plugin para Appointments and Events para WordPress es vulnerable a escalada de privilegios mediante restablecimiento de contrase\u00f1a en todas las versiones hasta la 5.2.7, inclusive. Esto se debe a que el plugin permite a los usuarios con un rol de Agente de LatePoint, que est\u00e1n creando nuevos clientes, establecer el campo 'wordpress_user_id'. Esto hace posible que atacantes autenticados, con acceso de nivel de Agente o superior, obtengan privilegios elevados al vincular un cliente a un ID de usuario arbitrario, incluidos los administradores, y luego restablecer la contrase\u00f1a."}], "id": "CVE-2026-1566", "lastModified": "2026-06-17T10:16:04.863", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1566", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T01:52:05.848759Z", "version": "2.0.3"}}]}, "published": "2026-03-03T00:15:55.133", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3463945/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.2.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "source": "cna", "vendor": "latepoint"}, "product": "latepoint_\u2013_calendar_booking_plugin_for_appointments_and_events", "vendor": "latepoint"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:52:14.192603+00:00", "value": {"mitigation_remediation": ["Upgrade the LatePoint plugin to version\u202f5.2.8 or newer to eliminate the vulnerability. ", "Temporarily disable password reset functionality for agents via plugin settings or a custom code snippet until the patch is applied. ", "After updating, audit customer data to ensure no Agent-created records are linked to privileged user IDs and reset any affected passwords immediately."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events, all releases up to and including version\u202f5.2.7, on WordPress sites that have any of these plugin versions installed.", "description_and_impact": "The LatePoint plugin for WordPress is vulnerable to privilege escalation through its password reset feature. The flaw allows any user with a LatePoint Agent role to specify the 'wordpress_user_id' when creating a new customer. By assigning an arbitrary user ID\u2014such as that of an administrator\u2014an authenticated attacker can subsequently reset the password for that account, granting elevated privileges and full control over the site.", "risk_and_exploitability": "The vulnerability carries a CVSS score of\u202f8.8 and a very low EPSS rate of less than\u202f1\u202fpercent, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an authenticated user holding an Agent role, who can create customers and reset passwords. Based on the description, it is inferred that an attacker only needs an existing Agent account to elevate privileges by linking a customer to an arbitrary WordPress user ID such as that of an administrator. The exploitation path requires no external access beyond valid authentication, making the risk medium to high for sites that expose the Agent role to untrusted users."}}}}, "created": "2026-03-03T08:40:50.517433+00:00", "updated": "2026-04-15T17:00:07.069527+00:00", "vendors": ["latepoint", "latepoint$PRODUCT$latepoint_\u2013_calendar_booking_plugin_for_appointments_and_events", "wordpress", "wordpress$PRODUCT$wordpress"]}