CVE-2026-13228— LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without checking its role. This makes it possible for authenticated attackers, with custom (Agent)-level access and above, to elevate their privileges to Administrator.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

特权管理不恰当

LatePoint 权限许可和访问控制问题漏洞

latepoint LatePoint – Calendar Booking Plugin for Appointments and Events是latepoint个人开发者的日历预订插件。 LatePoint 5.6.3及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于OsOrdersController的create_or_update()函数中存在不安全的直接对象引用，允许通过身份验证的Agent提供任意order[customer_id]并覆盖LatePoint客户的电子邮件字段，结合OsAu

N/A

N/A