CVE-2026-1566
Published: 03 March 2026
Summary
CVE-2026-1566 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-1566 is a privilege escalation vulnerability affecting the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, in all versions up to and including 5.2.7. The issue stems from the plugin permitting users with a LatePoint Agent role to set the 'wordpress_user_id' field when creating new customers, enabling improper linkage to arbitrary WordPress user accounts. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).
Authenticated attackers with LatePoint Agent-level access or higher can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By creating a new customer profile and assigning it an arbitrary 'wordpress_user_id'—such as that of an administrator—they can then perform a password reset on the linked account, gaining elevated privileges like full administrative control over the WordPress site.
Mitigation details are available in the referenced advisories, including the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset/3463945/, which likely contains the patch, and Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/c958880e-6068-4e7d-a780-1251f3ab9bf7?source=cve, recommending updates to fixed versions beyond 5.2.7.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9269
Vulnerability details
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint…
more
Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via improper account linkage and password reset on arbitrary WordPress users.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Least privilege restricts LatePoint Agent roles from assigning arbitrary WordPress user IDs to customer profiles, directly preventing privilege escalation to administrator accounts.
Information input validation on the 'wordpress_user_id' field rejects unauthorized or arbitrary values, blocking the core exploitation mechanism.
Access enforcement mechanisms ensure the plugin only permits LatePoint Agents to link customer profiles to user IDs commensurate with their privilege level.