CVE-2026-8176 latepoint CVE debrief

Who should care

Users of the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress, particularly those with Agent access or above, should be aware of this vulnerability. Administrators of WordPress installations with this plugin should prioritize updating to a patched version.

Technical summary

The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password. This is possible due to weaknesses in the plugin's code, specifically in the customer cabinet controller, customers controller, customer helper, and customer model.

Defensive priority

High

Recommended defensive actions

• Update the LatePoint – Calendar Booking Plugin for Appointments and Events plugin to a version beyond 5.5.1.
• Restrict Agent access and above to only trusted users.
• Monitor for suspicious activity, particularly privilege escalation attempts.

Evidence notes

Evidence from Wordfence indicates that the vulnerability was discovered and reported. Multiple references to specific lines of code in the plugin's files are provided, detailing the weaknesses that contribute to the vulnerability.

Official resources