CVE-2026-104766 in Appointment Booking Plugin
Summary
by MITRE • 10/10/2026
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Appointment Booking Plugin – LatePoint for WordPress affects all versions up to and including 5.7.3, representing a critical privilege escalation flaw rooted in insufficient input validation and server-side authorization checks. This issue arises from the improper handling of configuration settings within the plugin's administrative interface logic. Specifically, the OsSettingsController::update() method iterates over attacker-supplied parameters labeled as settings without implementing an allowlist to restrict which setting names or values can be modified. Furthermore, the helper function OsSettingsHelper::prepare_value(), responsible for sanitizing and persisting these configurations, fails to enforce role-based access controls when updating specific sensitive fields. This architectural oversight means that while the user interface may present a dropdown menu with restricted options for certain settings, this restriction is purely cosmetic and not mirrored by any server-side validation logic.
The technical core of the vulnerability lies in the handling of the default_wp_role_for_customer setting. In a secure implementation, this value should be strictly validated against a predefined list of acceptable WordPress roles to prevent unauthorized elevation of user privileges. However, due to the absence of such an allowlist during the persistence phase, an authenticated attacker can inject arbitrary values into this parameter. When combined with the lack of proper capability checks in the update handler, this allows for the modification of global plugin configuration data that dictates how new user accounts are created within the WordPress ecosystem. The flaw is particularly severe because it bypasses standard WordPress security mechanisms that typically rely on strict role definitions to maintain system integrity and isolate privileges between different levels of users.
The operational impact of this vulnerability is significant, as it enables authenticated attackers with relatively low-level permissions to escalate their access to full administrative control over the entire WordPress installation. To exploit this flaw, an attacker must first possess a LatePoint-specific role that has been granted the settings__edit capability by a WordPress administrator. This could include roles such as agent or any custom-defined role where site administrators have inadvertently delegated broad configuration rights. Once these conditions are met, the attacker can modify the default customer registration role to administrator. Subsequently, when a new user registers through the LatePoint booking system, that account is automatically created with full WordPress administrator privileges rather than the intended limited customer role. This effectively grants the attacker complete control over the website, including the ability to install plugins, modify themes, access sensitive data, and execute arbitrary code on the server.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Assignment, as it involves granting elevated privileges to users who should not possess them due to a failure in enforcing role-based constraints. Additionally, from an offensive security perspective, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, specifically the sub-technique of Local Account Manipulation or Privilege Escalation via configuration changes. The attack vector requires initial authentication but leverages misconfigured permissions to achieve a much higher level of access than originally intended by the system design. It highlights the danger of relying on client-side restrictions for security-critical settings and underscores the necessity of server-side validation for all user-supplied input that affects system state or privilege levels.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the LatePoint plugin to a version where this vulnerability has been patched, ensuring that the OsSettingsController::update() method implements strict allowlisting for permitted setting names and values. Developers should also enforce server-side validation of role assignments in the OsSettingsHelper::prepare_value() function to ensure that only predefined, safe WordPress roles can be assigned to new customers. For administrators currently running vulnerable versions, it is critical to audit which user roles have been granted the settings__edit capability and restrict this permission to trusted administrative accounts only. Regular security audits of plugin configurations and adherence to the principle of least privilege are essential practices to prevent similar privilege escalation vectors in WordPress environments.