The LatePoint plugin for WordPress is vulnerable to privilege escalation through its password reset feature. The flaw allows any user with a LatePoint Agent role to specify the 'wordpress_user_id' when creating a new customer. By assigning an arbitrary user ID—such as that of an administrator—an authenticated attacker can subsequently reset the password for that account, granting elevated privileges and full control over the site.

LatePoint – Calendar Booking Plugin for Appointments and Events, all releases up to and including version 5.2.7, on WordPress sites that have any of these plugin versions installed.

The vulnerability carries a CVSS score of 8.8 and a very low EPSS rate of less than 1 percent, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an authenticated user holding an Agent role, who can create customers and reset passwords. Based on the description, it is inferred that an attacker only needs an existing Agent account to elevate privileges by linking a customer to an arbitrary WordPress user ID such as that of an administrator. The exploitation path requires no external access beyond valid authentication, making the risk medium to high for sites that expose the Agent role to untrusted users.