CVE-2026-1566Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

6 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 6 signals
Disclosure: 6 classified signals
Peaked at 4 mentions on most recent observed day (2026-03-03)
6 total mentions across 2 days

Deep dive

Activity timeline6 mentions / 2d

Signal classification1 categories

Disclosure

6100.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	2	Disclosure2
2026-03-03	4	Disclosure4

Full discourse6 posts

The Hacker Wire@TheHackerWire220d
Disclosure
🟠 CVE-2026-1566 - High The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7.... https://www.thehackerwire.com/vulnerability/CVE-2026-1566/ https://t.co/zpA4Xl3KZh
Post summary
The post announces CVE-2026-1566, a privilege escalation vulnerability in the LatePoint WordPress plugin via password reset, without mentioning PoC, exploit code, or patch details.
0101051
121 followersView on X
CVEarity@CVEarity220d
Disclosure
⚡ New CVE Alert: CVE-2026-1566 📊 Severity: 8.8 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-1566 #CVE-2026-1566 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/Lcyl7SY25Z
Post summary
A new high‑severity CVE (CVE‑2026‑1566) affecting WordPress has been announced with severity 8.8 and risk level high, but no PoC, exploit, or patch details are provided.
0000059
64 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
Disclosure
CVE-2026-1566 Privilege Escalation in LatePoint WordPress Plugin via Unauthorized User ID Assignment https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1566
Post summary
A new privilege escalation vulnerability (CVE-2026-1566) in the LatePoint WordPress plugin has been disclosed, allowing unauthorized user ID assignment.
0000062
4.0K followersView on X
CVEFind.com@CveFindCom220d
Disclosure
[CVE-2026-1566: HIGH] LatePoint WordPress plugin (up to v5.2.7) has a vulnerability allowing user escalation via password reset. Attackers with Agent-level access could gain admin privileges.#cve,CVE-2026-1566,#cybersecurity https://cvefind.com/CVE-2026-1566
Post summary
LatePoint WordPress plugin versions up to 5.2.7 are vulnerable to user escalation via password reset, enabling attackers with Agent-level access to obtain admin privileges.
0000068
593 followersView on X
Infoflowcloud@infoflowcloud220d
Disclosure
🚨*CVE* CVE-2026-1566 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to,… https://www.cve.org/CVERecord?id=CVE-2026-1566 ----- Traducción: CVE-2026-1566 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-1566, highlighting a privilege escalation flaw via password reset in the LatePoint WordPress plugin, but offers no PoC, exploit, or patch details.
0000041
55 followersView on X
CVE@CVEnew220d
Disclosure
CVE-2026-1566 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to,… https://www.cve.org/CVERecord?id=CVE-2026-1566
Post summary
The LatePoint WordPress plugin is vulnerable to privilege escalation via password reset in all versions up to the CVE, but no PoC, exploit, or patch details are provided.
00000403
56.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-1566

The Hacker Wire@TheHackerWireDisclosure

The post announces CVE-2026-1566, a privilege escalation vulnerability in the LatePoint WordPress plugin via password reset, without mentioning PoC, exploit code, or patch details.

CVEarity@CVEarityDisclosure

A new high‑severity CVE (CVE‑2026‑1566) affecting WordPress has been announced with severity 8.8 and risk level high, but no PoC, exploit, or patch details are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new privilege escalation vulnerability (CVE-2026-1566) in the LatePoint WordPress plugin has been disclosed, allowing unauthorized user ID assignment.

CVEFind.com@CveFindComDisclosure

LatePoint WordPress plugin versions up to 5.2.7 are vulnerable to user escalation via password reset, enabling attackers with Agent-level access to obtain admin privileges.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-1566, highlighting a privilege escalation flaw via password reset in the LatePoint WordPress plugin, but offers no PoC, exploit, or patch details.

CVE@CVEnewDisclosure

The LatePoint WordPress plugin is vulnerable to privilege escalation via password reset in all versions up to the CVE, but no PoC, exploit, or patch details are provided.