WordPress Plugin Vulnerabilities

LatePoint < 5.5.2 - Contributor+ Privilege Escalation

Description

The plugin does not properly prevent users from escalating their privileges, allowing authenticated attackers with Contributor-level access and above to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.5.2

References

CVE
CVE-2026-49083
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ef818472-d4ba-4ca9-b7ed-fe563107c3bd

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (High)

Miscellaneous

Original Researcher
VanTastic
Verified
No
WPVDB ID
fdab84f0-93fe-4c80-bcef-1951402278d6

Timeline

Publicly Published
2026-06-05 (about 2 months ago)
Added
2026-06-10 (about 2 months ago)
Last Updated
2026-06-10 (about 2 months ago)

Other

Published
Title
Published
2025-07-11
Title
The E-Commerce ERP <= 2.1.1.3 - Unauthenticated Privilege Escalation
Published
2025-02-24
Title
Private Content <= 8.11.5 - Unauthenticated Privilege Escalation via Account Takeover
Published
2026-08-05
Title
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Privilege Escalation
Published
2024-04-25
Title
XStore Core < 5.3.9 - Unauthenticated Privilege Escalation
Published
2020-05-28
Title
bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled