# CVE-2026-7652: LatePoint WordPress plugin account takeover via weak password recovery mechanism

Source: https://junglewise.ai/threats/cve-2026-7652-latepoint-wordpress-plugin-account-takeover-via-weak-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-7652 · Severity: medium · CVSS 5.3 · Published 2026-05-09

The LatePoint plugin for WordPress, which manages appointment and event bookings, contains a security flaw that allows unauthorized individuals to take over user accounts. By exploiting a weakness in how the plugin handles guest bookings and phone-based contact merging, an attacker can change the email address associated with an existing WordPress account. This allows the attacker to reset the account password and gain full access, potentially compromising customer data and site operations.

Technologies: [LatePoint](https://junglewise.ai/threats/technologies/latepoint). Vendors: [LatePoint](https://junglewise.ai/threats/vendors/latepoint).

## Quick answers

**Is CVE-2026-7652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7652 being exploited in the wild.

**How severe is CVE-2026-7652?** Medium severity, with a CVSS score of 5.3, published 9 May 2026.

**Which products and versions are affected?** LatePoint <= 5.5.0, up to, and including, 5.5.0.

**Is there a fix for CVE-2026-7652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7652 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7652?** Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the LatePoint plugin up to version 5.5.0 due to the `save_connected_wordpress_user()` function improperly propagating email updates to linked WordPress accounts via `wp_update_user()` without ownership verification. An unauthenticated attacker can exploit the guest booking flow's phone-based merge feature to overwrite a customer's email address. If WordPress user integration is enabled and customer authentication is disabled, the attacker can change the email of a non-super-admin account and subsequently use the standard WordPress password reset flow to gain full access. Administrator accounts on single-site installs are reportedly not affected.

## Affected products

- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0

## Timeline

- 2026-05-09: disclosed
- 2026-05-09: advisory

## References

- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/latepoint.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/latepoint.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/customer_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/customer_helper.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/latepoint.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/latepoint.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php)

## Related threats

- [LatePoint authentication bypass via SQL injection in password reset](https://junglewise.ai/threats/cve-2026-118066-the-appointment-booking-plugin-latepoint-calendar-scheduling-for)
- [LatePoint stored cross-site scripting in customer email parameter](https://junglewise.ai/threats/cve-2026-119152-the-appointment-booking-plugin-latepoint-calendar-scheduling-for)
- [LatePoint WordPress plugin stored XSS in booking form settings](https://junglewise.ai/threats/cve-2026-105258-the-appointment-booking-plugin-wordpress-plugin-before-5-7-6)
- [LatePoint WordPress plugin payment bypass in booking checkout](https://junglewise.ai/threats/cve-2026-105256-the-latepoint-wordpress-plugin-before-5-7-5-does-not-validate)
- [LatePoint WordPress plugin IDOR in customer data access](https://junglewise.ai/threats/cve-2026-105257-the-appointment-booking-plugin-wordpress-plugin-before-5-7-5)