WordPress Plugin Vulnerabilities

LatePoint < 5.5.2 - Agent+ Privilege Escalation to Administrator

Description

The plugin does not properly prevent privilege escalation, allowing authenticated attackers with Agent-level access and above to overwrite a WordPress Administrator's password and thereby elevate their privileges to Administrator.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.5.2

References

CVE
CVE-2026-8176
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
d.v4n_s3c
Verified
No
WPVDB ID
a595e025-cca5-4e15-bbe4-ab8d12b8f830

Timeline

Publicly Published
2026-06-15 (about 2 months ago)
Added
2026-06-16 (about 2 months ago)
Last Updated
2026-06-16 (about 2 months ago)

Other

Published
Title
Published
2026-05-22
Title
WishList Member < 3.31.0 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action
Published
2023-07-31
Title
Shop as a Customer for WooCommerce < 1.2.4 - Shop Manager+ Privilege Escalation
Published
2026-02-07
Title
JAY Login & Register < 2.6.04 - Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile
Published
2021-03-15
Title
Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation
Published
2026-06-01
Title
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'