The vulnerability in the LatePoint Calendar Booking Plugin for WordPress is an insecure direct object reference that lets an authenticated user with Agent or higher privileges arbitrarily set the order[customer_id] parameter during a create or update operation, causing the plugin to overwrite the associated customer’s email address; because the authorization helper lacks a role check, the user is logged in as the WordPress account linked to that email, resulting in a full elevation to the site’s administrator. This CWE-269 flaw bypasses expected access controls that separate customer data from administrative rights, leading, ando the user reaches the create_or_update endpoint, as the attacker simply supplies a crafted order[customer_id] value without needing additional absence of role verification in the plugin’s login logic makes the escalation trivial and allows attackers to take control of the site.

All versions of the LatePoint – Calendar Booking up to and including 5.6.3 are affected; the issue is confined to this plugin and does not extend to core WordPress or other plugins.

The CVSS score of 8.8 indicates high severity and the EPSS score is < 1%, indicating a very low but nonzero exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated user reaching the plugin’s create_or_update endpoint, which can be authenticated via any regular user login, and the attacker only needs to submit a crafted order[customer_id] value; once the customer record is updated, the plugin logs in the targeted user without role verification, effectively hijacking the administrator. The straightforward nature of the exploit and absence of mitigations means overall risk is significant for any WordPress site running the vulnerable plugin.