The vulnerability arises from a missing authorization check in the connect-customer-to-wp-user ability of LatePoint. An authenticated user who holds the latepoint_agent role can call the execute() method with only the customer__edit capability, which fails to confirm that the target WordPress user ID is a privileged account. Through this flaw the attacker can associate any LatePoint customer record with an administrator’s WordPress account and then trigger the normal customer password‑reset process, ultimately allowing the attacker to take full control of the site.

LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, versions 5.4.1 and earlier.

The CVSS score of 8.8 signals a high‑severity vulnerability. Exploitation requires only an authenticated WordPress account possessing the default latepoint_agent role; no additional privileges or external access are needed. The lack of an authorization check provides a clear and direct path for privilege escalation. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, but the capacity for an attacker to seize administrative credentials makes immediate attention essential.