The LatePoint Calendar Booking Plugin for WordPress contains a critical privilege escalation flaw that allows authenticated users to perform a full administrative site takeover.

The vulnerability exists due to a missing authorization check in the execute method of the connect-customer-to-wp-user component, which allows an authenticated attacker with the latepoint_agent role to link a customer record to an administrator account and reset their password.

Successful exploitation of this vulnerability results in full administrative control over the WordPress site, leading to total compromise of data, unauthorized modifications, and potential long-term persistence by the attacker. With a CVSS score of 8.8, this high-severity flaw poses a significant risk to organizational security and operational integrity, as it bypasses standard access control mechanisms.

Immediate Action: Update the LatePoint plugin to the latest version, ensuring all instances are patched beyond version 5.4.1.

Proactive Monitoring: Monitor WordPress user management logs for unexpected administrative password resets or the creation of new high-privilege accounts, especially those associated with the latepoint_agent role.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block unauthorized access to administrative functions and monitor for unusual API calls targeting the connect-customer-to-wp-user endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

The severity of this privilege escalation necessitates immediate action from security teams. Organizations using the LatePoint plugin must verify their current version and apply updates immediately, as the existence of a public proof-of-concept increases the likelihood of opportunistic exploitation. Failure to remediate this flaw exposes the entire WordPress environment to unauthorized administrative access.