Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and subsequently reset the administrator's password via the normal customer password-reset flow, resulting in full site takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-27 | 1 | Disclosure1 |
| 2026-04-28 | 1 | General1 |
CVE-2026-6741 Privilege Escalation in LatePoint Calendar Booking Plugin for WordPress 5.4.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6741
Post summary
The CVE-2026-6741 identifies a privilege escalation vulnerability in the LatePoint Calendar Booking Plugin for WordPress 5.4.1, but the text lacks detailed technical, exploit, or mitigation information.
⚠️ HIGH — CVE-2026-6741 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Esc… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6741 #WordPress #CyberSecurity #InfoSec
Post summary
The post announces a high‑severity vulnerability (CVE‑2026‑6741) in a WordPress calendar booking plugin with a CVSS score of 8.8, but offers no PoC, exploit code, or patch information.