CVE-2026-49083: WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

Synopsis

An authentication bypass leading to privilege escalation affects the LatePoint WordPress plugin at version 5.5.1 and earlier. The vulnerability is reachable over the network and requires only a low-privilege (contributor-level) account, with no additional victim interaction needed. Successful exploitation allows an attacker to fully compromise confidentiality, integrity, and availability of the affected environment by elevating their privileges beyond the contributor role. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable plugin endpoint is exposed via standard HTTP(S) requests.

• AuthenticationRequired

  A low-privilege account (contributor level) is sufficient; no administrative credentials are needed, but unauthenticated access alone does not trigger the vulnerability.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can exploit the flaw directly after authenticating.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on specific conditions such as race conditions, particular configuration states, or environmental factors that the attacker cannot fully control.

Blast Radius

• Attacker elevates their WordPress role beyond contributor, gaining write and administrative access to site content, settings, and installed plugins.
• With elevated privileges, the attacker reads stored user data, credentials, and any private content held in the WordPress database.
• The attacker modifies or deletes posts, pages, plugin configurations, and site settings, corrupting persisted application data.
• Abuse of administrative capabilities can render the WordPress site unavailable, for example by deactivating critical plugins or corrupting core configuration.