# CVE-2026-8176: LatePoint Calendar Booking privilege escalation to Administrator

Source: https://junglewise.ai/threats/cve-2026-8176-latepoint-calendar-booking-privilege-escalation-to-administrator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-8176 · Severity: high · CVSS 7.5 · Published 2026-06-16

A vulnerability in the LatePoint booking plugin for WordPress allows users with 'Agent' level access to take over administrator accounts. By exploiting a chain of flaws, an attacker can reset an administrator's password and gain full control over the website. This could lead to total site compromise, data theft, or service disruption.

Technologies: [LatePoint](https://junglewise.ai/threats/technologies/latepoint). Vendors: [LatePoint](https://junglewise.ai/threats/vendors/latepoint).

## Quick answers

**Is CVE-2026-8176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8176 being exploited in the wild.

**How severe is CVE-2026-8176?** High severity, with a CVSS score of 7.5, published 16 June 2026.

**Which products and versions are affected?** LatePoint up to, and including, 5.5.1.

**Is there a fix for CVE-2026-8176?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8176 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8176?** Check whether you run LatePoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The LatePoint plugin for WordPress contains a privilege escalation vulnerability (CWE-269) affecting versions up to 5.5.1. The vulnerability arises from a chain of three independent flaws that allow an authenticated user with 'Agent' privileges or higher to overwrite a WordPress Administrator's password. Notably, this exploit bypasses the need to invoke any Administrator-only APIs. The attack vector is network-based and requires low-level authentication, though the complexity is rated as high. A patch has been released in subsequent versions to address these logic flaws.

## Affected products

- LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events up to, and including, 5.5.1

## Timeline

- 2026-06-16: disclosed
- 2026-06-16: advisory

## References

- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customers_controller.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customers_controller.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php)
- [https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php](https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php)

## Related threats

- [LatePoint authentication bypass via SQL injection in password reset](https://junglewise.ai/threats/cve-2026-118066-the-appointment-booking-plugin-latepoint-calendar-scheduling-for)
- [LatePoint stored cross-site scripting in customer email parameter](https://junglewise.ai/threats/cve-2026-119152-the-appointment-booking-plugin-latepoint-calendar-scheduling-for)
- [LatePoint WordPress plugin stored XSS in booking form settings](https://junglewise.ai/threats/cve-2026-105258-the-appointment-booking-plugin-wordpress-plugin-before-5-7-6)
- [LatePoint WordPress plugin payment bypass in booking checkout](https://junglewise.ai/threats/cve-2026-105256-the-latepoint-wordpress-plugin-before-5-7-5-does-not-validate)
- [LatePoint WordPress plugin IDOR in customer data access](https://junglewise.ai/threats/cve-2026-105257-the-appointment-booking-plugin-wordpress-plugin-before-5-7-5)