CVE-2026-8176

Vulnerability

The LatePoint Calendar Booking Plugin for WordPress versions up to and including 5.5.1 contains a privilege escalation vulnerability that chains three independent flaws. The plugin exposes the continue_order_intent and continue_transaction_intent actions as public endpoints [1][3], allowing any authenticated user with Agent+ access to manipulate order intents. Through a sequence of steps, an attacker can overwrite a WordPress Administrator's password without invoking any Administrator-only API, thereby escalating privileges to Administrator.

Exploitation

An attacker needs an authenticated account with at least Agent (Agent+) access. By crafting requests to the public continue_order_intent and continue_transaction_intent endpoints, the attacker can exploit the flawed logic to modify order intents in a way that leads to overwriting an Administrator's password. The exact sequence involves sending specially crafted parameters to these endpoints, leveraging the lack of proper authorization checks on the underlying functions [2][4].

Impact

Successful exploitation allows the attacker to gain Administrator-level privileges on the WordPress site. This results in full control over the site, including the ability to modify content, install plugins, change user roles, and exfiltrate data. The confidentiality, integrity, and availability of the site are completely compromised.

Mitigation

As of the publication date of this CVE, no official patch has been released by the plugin vendor. Users are advised to restrict the use of Agent-level accounts to trusted users only and to monitor for any suspicious activity. The plugin should be updated as soon as a fixed version becomes available. If no fix is forthcoming, consider disabling the plugin or replacing it with an alternative.