CVE-2026-8176— LatePoint – Calendar Booking Plugin for Appointments and Events 权限许可和访问控制问题漏洞

LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

特权管理不恰当

LatePoint – Calendar Booking Plugin for Appointments and Events 权限许可和访问控制问题漏洞

latepoint LatePoint – Calendar Booking Plugin for Appointments and Events是latepoint个人开发者的日历预订插件。 LatePoint – Calendar Booking Plugin for Appointments and Events 5.5.1及之前版本存在安全漏洞，该漏洞源于连锁三个独立缺陷允许已认证的Agent（Agent+）覆盖WordPress管理员密码，且无需调用管理员专用API，可能导致经过身份验证的攻击者

N/A

N/A