CVE-2026-1566: 
WordPress vulnerability analysis and mitigation

CVE-2026-1566 is a privilege escalation vulnerability via password reset in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, affecting all versions up to and including 5.2.7. The flaw allows authenticated attackers with Agent-level access to link a customer account to an arbitrary WordPress user ID (including administrators) and then reset that administrator's password, effectively gaining full administrative control. It was published on March 3, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, ENISA EUVD).

The root cause is improper privilege management (CWE-269): when a LatePoint Agent creates a new customer, the plugin fails to restrict or validate the wordpress_user_id field, allowing the agent to associate the new customer record with any existing WordPress user ID, including site administrators. An attacker exploits this by submitting a crafted customer-creation request with a target administrator's wordpress_user_id, then triggering the plugin's password reset flow for that customer — which resets the linked administrator's WordPress account password. The attack requires only network access and a valid Agent-level account; no user interaction from the victim is needed (Wordfence, infinitsec).

Successful exploitation grants an attacker full administrative access to the WordPress installation, enabling unauthorized content modification, malware injection, data theft, creation of backdoor accounts, and complete site takeover. All three security pillars are affected — confidentiality (access to all site data and credentials), integrity (ability to modify any content or settings), and availability (potential to disable or destroy the site). Any WordPress site running LatePoint ≤ 5.2.7 with at least one Agent-role user is at risk (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin (version ≤ 5.2.7) by inspecting page source, plugin-specific URLs, or using tools like WPScan. Enumerate the target administrator's WordPress user ID (often user ID 1 for the first admin, or discoverable via the WordPress REST API at /wp-json/wp/v2/users).
2. Obtain Agent credentials: Acquire a LatePoint Agent-level account through registration, social engineering, or credential compromise — the minimum privilege required for exploitation.
3. Create a malicious customer record: While authenticated as an Agent, submit a customer creation request (e.g., via the LatePoint admin panel or a crafted POST request to the relevant endpoint) and set the wordpress_user_id field to the target administrator's user ID.
4. Trigger password reset: Use the LatePoint plugin's password reset functionality for the newly created customer account. Because the customer is now linked to the administrator's WordPress user ID, the reset will change the administrator's WordPress account password.
5. Gain administrative access: Log in to WordPress using the administrator's username and the newly reset password, achieving full site administrative control (Wordfence, infinitsec).

• Logs: WordPress authentication logs showing an administrator account logging in from an unfamiliar IP address or at an unusual time shortly after a LatePoint customer creation event; password reset log entries for administrator accounts not initiated by the administrator themselves.
• Database: Unexpected entries in the LatePoint customers table where wordpress_user_id references a high-privilege WordPress user (e.g., administrator); review wp_latepoint_customers for anomalous user ID associations.
• WordPress Activity: New administrator-level sessions or actions (plugin installs, user creation, settings changes) not attributable to known admins; unexpected changes to wp_users or wp_usermeta tables reflecting password hash updates for admin accounts.
• Network: POST requests to LatePoint customer creation endpoints (e.g., /wp-admin/admin-ajax.php with LatePoint-specific action parameters) containing a wordpress_user_id parameter set to a known admin user ID, originating from Agent-role sessions.

The primary remediation is to update the LatePoint – Calendar Booking Plugin to a version newer than 5.2.7 once a patched release is available; the fix was committed in the WordPress plugin repository (changeset 3463945) (WordPress SVN). Until patching is possible, restrict the LatePoint Agent role exclusively to fully trusted users and audit existing Agent accounts. Consider temporarily disabling the plugin if it is not actively required. Implement WordPress activity logging (e.g., via a security plugin) to monitor for suspicious customer creation events or unexpected administrator password resets (Wordfence, Sucuri Blog).

Wordfence, which discovered and assigned the CVE, published the vulnerability in their weekly WordPress vulnerability report for the week of March 2–8, 2026, highlighting it as a notable privilege escalation risk (Wordfence Blog). Sucuri included it in their March 2026 vulnerability patch roundup, recommending prompt updates (Sucuri Blog). The vulnerability received standard automated coverage across security aggregators (VulDB, Vulners, RedPacket Security) and social platforms (Bluesky, Mastodon), with no exceptional community controversy or debate noted.