CVE-2026-13228: LatePoint Privilege Escalation to WordPress Administrator

Technical summary

CVE-2026-13228 stems from two compounding weaknesses in LatePoint versions through 5.6.3. First, the OsOrdersController::create_or_update() function has an Insecure Direct Object Reference (IDOR) that fails to validate ownership before allowing an authenticated Agent to modify arbitrary customer records via the order[customer_id] parameter. Second, the OsAuthHelper::authorize_customer() method logs in the WordPress user linked to a customer account without verifying the user's role. By combining these flaws, an attacker with Agent credentials can overwrite a target administrator's email in the LatePoint customer database, then trigger the authorization routine to gain Administrator access in WordPress.

Business impact

Successful exploitation grants complete administrative control over an affected WordPress installation, enabling attackers to modify site content, install malicious plugins, steal sensitive data, create backdoors, or take the site offline. For businesses using LatePoint to manage appointment scheduling, client relationships, or payment processing, this represents a critical integrity and confidentiality breach. The attack requires only low-privilege plugin access, which is often granted to scheduling staff or contractors, dramatically expanding the threat surface.

Affected systems

LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress in versions 5.6.3 and earlier. Any WordPress site running this plugin with Agent-level users or higher is vulnerable. The vulnerability affects all WordPress installations regardless of version, as long as the vulnerable LatePoint plugin is active.

Exploitability

This vulnerability is readily exploitable by anyone with Agent credentials or higher within the LatePoint plugin. No user interaction is required, no complex network conditions must be met, and the attack is entirely unauthenticated from the WordPress perspective once the agent is logged into the plugin. The low attack complexity and straightforward object reference manipulation make this a high-risk issue that will likely see rapid weaponization once public details emerge.

Remediation

Update the LatePoint plugin to a patched version released after the 2026-07-01 publication date (verify against the vendor advisory for the exact version number). If immediate patching is not possible, consider temporarily disabling the plugin, restricting Agent account creation to trusted personnel only, or implementing WordPress user role restrictions and monitoring admin account activity for suspicious logins. Review LatePoint access logs for any evidence of unauthorized administrative login attempts.

Patch guidance

Check the LatePoint plugin repository or the vendor's security advisory for a version released after July 1, 2026, that addresses both the IDOR flaw in create_or_update() and the missing role validation in authorize_customer(). Apply the patch immediately to all affected WordPress installations. After updating, audit any user accounts created or modified during the vulnerability window and verify that no unauthorized administrative accounts exist.

Detection guidance

Monitor WordPress error logs and authentication logs for unexpected logins from Agent-level accounts escalating to Administrator role. Query your WordPress user table for recently modified accounts or suspicious email changes to admin users. In the LatePoint customer database, look for customer records with modified email fields that do not align with normal business activity. Enable WordPress security plugins to alert on privilege escalation events and unusual login patterns from non-administrative user accounts.

Why prioritize this

This vulnerability scores 8.8 (HIGH) because it offers high impact (full administrative control), low attack complexity, low privilege requirements (Agent access is routine), and no user interaction. The two chained weaknesses—IDOR plus missing role verification—create a straightforward escalation path that requires minimal attacker skill. Any organization with LatePoint installed and active Agent accounts should treat this as an immediate security priority, especially if agents have access to customer or financial data.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires low privilege (PR:L) and no user interaction (UI:N). Impact is high across confidentiality, integrity, and availability (C:H/I:H/A:H) because successful exploitation yields full administrative control. The vulnerability is not scoped to a separate component (S:U), so the entire WordPress installation is compromised. This high score is justified by the ease of exploitation and the severity of the outcome.

Frequently asked questions