Is CVE-2026-8176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8176 being exploited in the wild.

How severe is CVE-2026-8176?

High severity, with a CVSS score of 7.5, published 16 June 2026.

Which products and versions are affected?

LatePoint up to, and including, 5.5.1.

Is there a fix for CVE-2026-8176?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8176 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8176?

Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8176: LatePoint Calendar Booking privilege escalation to Administrator

CVE-2026-8176 · Severity: high · CVSS 7.5 · Published 2026-06-16

A vulnerability in the LatePoint booking plugin for WordPress allows users with 'Agent' level access to take over administrator accounts. By exploiting a chain of flaws, an attacker can reset an administrator's password and gain full control over the website. This could lead to total site compromise, data theft, or service disruption.

Technologies: LatePoint. Vendors: LatePoint.

Quick answers

Is CVE-2026-8176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8176 being exploited in the wild.
How severe is CVE-2026-8176?: High severity, with a CVSS score of 7.5, published 16 June 2026.
Which products and versions are affected?: LatePoint up to, and including, 5.5.1.
Is there a fix for CVE-2026-8176?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8176 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8176?: Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The LatePoint plugin for WordPress contains a privilege escalation vulnerability (CWE-269) affecting versions up to 5.5.1. The vulnerability arises from a chain of three independent flaws that allow an authenticated user with 'Agent' privileges or higher to overwrite a WordPress Administrator's password. Notably, this exploit bypasses the need to invoke any Administrator-only APIs. The attack vector is network-based and requires low-level authentication, though the complexity is rated as high. A patch has been released in subsequent versions to address these logic flaws.

Affected products

LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events up to, and including, 5.5.1

Timeline

2026-06-16: disclosed
2026-06-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.