WordPress LatePoint Plugin Unrestricted Privilege Escalation

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has g

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Appointment Booking Plugin – LatePoint contains a critical privilege escalation vulnerability in its settings update handler that allows attackers to modify WordPress role assignments without proper authorization controls. The `OsSettingsController::update()` method accepts arbitrary settings parameters from user input without validating against an allowlist, and critically, the `OsSettingsHelper::prepare_value()` function fails to enforce role-based access controls before persisting the `default_wp_role_for_customer` setting. This means an unauthenticated or low-privileged attacker can elevate their account to administrator status or assign arbitrary roles to accounts, completely bypassing WordPress's permission model. Any website running LatePoint versions 5.7.3 and earlier is vulnerable, making this a widespread risk across the estimated thousands of WordPress installations using this popular scheduling plugin.

Casky's security skills leverage Claude AI with extended reasoning to map this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), connecting 224 relevant detection patterns across the attack chain. Practitioners using Casky would identify this attack through detection of: (1) suspicious HTTP POST requests to the LatePoint settings endpoint with modified role parameters in the request body, (2) unusual database modifications to WordPress user meta fields that control role assignments without corresponding legitimate admin actions, (3) account privilege changes occurring outside normal administrative workflows, and (4) low-privileged users or service accounts suddenly gaining elevated capabilities. The platform's extended reasoning would correlate these indicators with the specific parameter manipulation technique and role-modification patterns, enabling teams to detect both exploitation attempts and post-compromise role elevation tactics before attackers establish persistent administrative access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104766.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104766

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104766. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn