CVE-2026-13228
Last modified
CVE-2026-13228 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without checking its role. This makes it possible for authenticated attackers, with custom (Agent)-level access and above, to elevate their privileges to Administrator..
Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without checking its role. This makes it possible for authenticated attackers, with custom (Agent)-level access and above, to elevate their privileges to Administrator.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| latepoint | LatePoint – Calendar Booking Plugin for Appointments and Events | <= 5.6.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-13228?
How severe is CVE-2026-13228?
How do I fix CVE-2026-13228?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13221Perl versions through 5.43.9 produce silently incorrect regu…9.1
- CVE-2026-13222Our payment integration with Oppwa-based payment methods did…6.3
- CVE-2026-13223Our payment integration with Computop-based payment methods …6.3
- CVE-2026-13225Malicious HTML content could be injected into the email addr…5.3
- CVE-2026-13226The Groundhogg — CRM, Newsletters, and Marketing Automation …6.5
- CVE-2026-13227An Improper Authorization vulnerability exists in ERPNext ve…7.1
- CVE-2026-13229Zammad 7.1.0 contains an authenticated improper authorizatio…7.1
- CVE-2026-1323The extension fails to properly define allowed classes used …8.8
- CVE-2026-13230An information disclosure vulnerability was identified in TP…6.5
- CVE-2026-13231Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2026-13232Incorrect Authorization vulnerability in Drupal Advanced Con…3.1
- CVE-2026-13233Server-Side Request Forgery (SSRF) vulnerability in Drupal O…3.3
Are you affected by CVE-2026-13228?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST