CVE-2026-6741: 
WordPress vulnerability analysis and mitigation

CVE-2026-6741 is a privilege escalation vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, affecting versions up to and including 5.4.1. The flaw allows authenticated attackers holding the latepoint_agent role to escalate privileges to full site administrator access. It was published on April 27, 2026, with a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Wordfence).

The root cause is a missing authorization check (CWE-269: Improper Privilege Management; CWE-862: Missing Authorization) in the execute() method of the connect-customer-to-wp-user ability within the LatePoint plugin. The latepoint_agent role is granted the customer__edit capability by default, which is sufficient to invoke this method — but the method fails to verify whether the target WordPress user ID corresponds to a privileged account such as an administrator. An attacker exploits this by sending an authenticated request to link an arbitrary LatePoint customer record to an administrator's WordPress user ID, then triggering a standard customer password-reset flow to gain control of the administrator account (GitHub Advisory, Wordfence).

Successful exploitation results in full WordPress site takeover. An attacker with the latepoint_agent role can reset an administrator's password and gain unrestricted administrative access, enabling them to modify site content, install malicious plugins or themes, exfiltrate sensitive data, create backdoor accounts, and maintain persistent access to the WordPress installation. All three security pillars — confidentiality, integrity, and availability — are rated High impact (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.05–0.064%, placing it in the 20th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with the latepoint_agent role, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin version 5.4.1 or earlier. This can be done by checking the plugin's readme.txt file (e.g., https://target.com/wp-content/plugins/latepoint/readme.txt) or using tools like WPScan.
2. Obtain latepoint_agent credentials: Acquire or register an account with the latepoint_agent role on the target WordPress site. This role may be assigned to booking agents or staff members.
3. Identify administrator user ID: Enumerate WordPress user IDs for administrator accounts via the WordPress REST API (e.g., GET /wp-json/wp/v2/users) or other enumeration techniques to find the target admin's user ID.
4. Link customer record to administrator: Send an authenticated POST request invoking the connect-customer-to-wp-user ability's execute() method, supplying the administrator's WordPress user ID as the target. Because no authorization check validates whether the target user is privileged, the request succeeds.
5. Trigger password reset: Use the standard LatePoint customer password-reset flow for the now-linked customer record. The password reset email is sent to the administrator's email address.
6. Achieve full site takeover: Use the reset link to set a new password for the administrator account, then log in to WordPress with full administrative privileges (GitHub Advisory, Wordfence).

• Logs: WordPress authentication logs showing a password reset event for an administrator account initiated from the LatePoint customer portal; unexpected admin login from an unfamiliar IP address shortly after a password reset.
• Logs: Web server access logs showing POST requests to LatePoint's connect-customer-to-wp-user endpoint (e.g., paths under /wp-admin/admin-ajax.php with LatePoint action parameters) from a latepoint_agent session.
• WordPress Activity: Unexpected changes to administrator account email or password in WordPress user management logs; new administrator accounts created after the incident.
• File System: Newly installed or modified plugins/themes not authorized by legitimate administrators; presence of web shells or backdoor files in the WordPress installation directory.
• Network: Outbound connections from the WordPress server to unknown external IPs following a suspicious admin login event.

Organizations should immediately update the LatePoint plugin to a version beyond 5.4.1 that includes the authorization fix (see the plugin changelog at https://plugins.trac.wordpress.org/changeset/3514330/latepoint). As a workaround prior to patching, restrict assignment of the latepoint_agent role to only fully trusted users, and audit existing agent accounts for unauthorized access. Additionally, monitor WordPress administrator accounts for unexpected password reset requests and implement multi-factor authentication on admin accounts to reduce the impact of credential compromise (GitHub Advisory, Wordfence).

Wordfence covered CVE-2026-6741 in its weekly WordPress vulnerability report for the period of April 27 – May 3, 2026, highlighting it as a notable privilege escalation issue (Wordfence Weekly Report). RedPacket Security also flagged the vulnerability via social media and their CVE alert feed (RedPacket Security). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.