CVE-2026-104766 latepoint CVE debrief

Who should care

Defenders responsible for WordPress installations with the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress should assess exposure and prioritize remediation, especially if the `settings__edit` capability is granted to non-administrator roles.

Why it matters

CVE-2026-104766 allows authenticated attackers to escalate privileges by overwriting the default WordPress role for new customers with `administrator`, impacting WordPress installations with the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress.

• Potential privilege escalation to administrator role for self-registered customer accounts.
• Possible unauthorized access to sensitive WordPress functionality.
• Required verification of customer account roles and settings.
• Necessity to restrict the `settings__edit` capability to trusted roles.

Technical summary

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin is vulnerable to Privilege Escalation due to improper validation of the `settings` parameters in the `OsSettingsController::update()` handler and `OsSettingsHelper::prepare_value()`. This allows authenticated attackers with the `settings__edit` capability to overwrite the default WordPress role for new customers with `administrator`, potentially leading to unauthorized access to sensitive WordPress functionality. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where the `settings__edit` capability is granted to non-administrator roles. The vulnerability exists due to the `

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where the `settings__edit` capability is granted to non-administrator roles.

Recommended defensive actions

• Verify the version of the Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress and upgrade to a patched version if necessary.
• Review and restrict the `settings__edit` capability to only trusted roles.
• Monitor for new customer account registrations and verify their roles.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Conduct a thorough review of existing customer accounts to identify potential unauthorized access.
• Update incident response plans to include procedures for addressing potential privilege escalation attacks.
• Perform a comprehensive asset inventory to identify all systems that may be affected by this vulnerability.

Evidence notes

The vulnerability exists due to the `OsSettingsController::update()` handler and `OsSettingsHelper::prepare_value()` not enforcing role allowlist validation for the `default_wp_role_for_customer` setting. This allows attackers with the `settings__edit` capability to escalate privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.