---
cve: "CVE-2026-8176"
severity: "HIGH"
cvss: 7.5
epss: "0.6%"
vendor: "latepoint"
kev: false
exploited: false
published: "2026-06-16 09:31:33"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T20:25:30+02:00"
---

# CVE-2026-8176

> 7.5 HIGH

## Beschreibung

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Wordfence**
- State: PUBLISHED
- Stand: 2026-06-16 14:53:59
- CNA-CVSS: **7.5** (`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-269** — Improper Privilege Management
  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

## Angriffsmuster (CAPEC)

- [CAPEC-58 — Restful Privilege Elevation](https://capec.mitre.org/data/definitions/58.html) _(Severity: High)_
- [CAPEC-122 — Privilege Abuse](https://capec.mitre.org/data/definitions/122.html) _(Severity: Medium)_
- [CAPEC-233 — Privilege Escalation](https://capec.mitre.org/data/definitions/233.html)

## ATT&CK-Techniken

- [T1548 — Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)

## Referenzen

- <https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d5bb6c-2021-4fc0-bede-8da1c3fb591a?source=cve>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/orders_controller.php#L124>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/orders_controller.php#L124>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/orders_controller.php#L100>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/orders_controller.php#L100>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/models/customer_model.php#L427>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/models/customer_model.php#L322>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/models/customer_model.php#L322>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php#L491>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php#L491>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php#L415>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customer_cabinet_controller.php#L415>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/customer_helper.php#L253>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/helpers/customer_helper.php#L253>
- <https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customers_controller.php#L342>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.1/lib/controllers/customers_controller.php#L342>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php#L322>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L491>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customer_cabinet_controller.php#L415>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L253>
- <https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/customers_controller.php#L342>
- <https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3531832%40latepoint&old=3522933%40latepoint&sfp_email=&sfph_mail=>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-8176/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_