CVE-2026-8176: LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

Synopsis

This is a privilege escalation vulnerability in the LatePoint Calendar Booking Plugin for WordPress, affecting versions up to and including 5.5.1. An authenticated attacker with at least Agent-level access can exploit a chain of three flaws, including an Insecure Direct Object Reference (IDOR) in the orders controller and an unauthenticated password reset in the customer cabinet, to overwrite a WordPress Administrator's password without using any admin-restricted API. Successful exploitation gives the attacker full Administrator access to the WordPress site, enabling complete control over site content, users, and configuration. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; the vulnerability is exposed via standard HTTP endpoints with no requirement for local or physical access.

• AuthenticationRequired

  The attacker must hold at least an Agent-level account in LatePoint; any low-privilege Agent credential is sufficient to begin the exploit chain.

• Victim interactionNot required

  No victim action, such as clicking a link or visiting a page, is needed; the attacker drives the full exploit chain server-side without any user participation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit chain depends on specific conditions or sequencing across the three chained flaws, making it less reliably repeatable than a single-step exploit.

Blast Radius

• Attacker overwrites a WordPress Administrator account password, taking full ownership of that account.
• Attacker gains Administrator-level access to the WordPress dashboard, able to install or modify plugins and themes, alter site content, and change site configuration.
• With Administrator access, the attacker reads all data stored in the WordPress database, including user records, session tokens, and any personal or transactional data managed by LatePoint.
• The attacker can create, modify, or delete any WordPress content, users, or settings, effectively taking over the entire site.