| CVE ID | CVE-2026-104766 |
| Severity | HIGH — CVSS CVSS V3.1 8.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-269 CWE-269 Improper Privilege Management |
| Produk | latepoint / Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress — 0 (affected) |
| Dipublikasikan | 2026-10-10 |
Ringkasan Cepat
- CVE-2026-104766 adalah kerentanan privilege escalation HIGH 8.8 pada Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress hingga versi 5.7.3.
- Handler OsSettingsController::update() memproses parameter settings dari penyerang tanpa allowlist, dan OsSettingsHelper::prepare_value() tidak memvalidasi role sebelum menyimpan default_wp_role_for_customer.
- Dampaknya, akun customer LatePoint yang mendaftar setelah perubahan setting dapat dibuat dengan hak administrator WordPress, jika administrator telah memberi capability settings__edit kepada agen atau custom role.
Ringkasan Kerentanan
CVE-2026-104766 adalah kerentanan privilege escalation pada Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Menurut deskripsi resmi, plugin ini rentan pada semua versi hingga, dan termasuk, 5.7.3. Severity tercatat HIGH 8.8 dengan vektor CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H dan kategori CWE-269 Improper Privilege Management. Publikasi CVE: 2026-10-10T05:30:57.307Z.
Judul CNA menyoroti parameter settings[default_wp_role_for_customer] sebagai jalur eskalasi hak akses terautentikasi.
Dampak Teknis
Kerentanan terjadi karena handler OsSettingsController::update() melakukan iterasi terhadap parameter settings yang dipasok penyerang tanpa allowlist nama atau nilai setting yang diizinkan. Selain itu, OsSettingsHelper::prepare_value() tidak melakukan validasi allowlist role sebelum menyimpan setting default_wp_role_for_customer. Pembatasan role hanya ada pada dropdown UI dan tidak pernah ditegakkan di sisi server.
Akibatnya, penyerang terautentikasi yang memiliki peran LatePoint dengan capability settings__edit, misalnya agen atau custom role, dapat menimpa default role WordPress untuk customer baru menjadi administrator. Setelah setting berbahaya tersimpan, setiap akun customer LatePoint yang mendaftar sendiri dapat dibuat dengan hak penuh administrator WordPress.
Produk Terdampak
Vendor: latepoint. Produk: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Versi terdampak: 0 (affected), dengan cakupan semua versi hingga, dan termasuk, 5.7.3.
Eksploitasi tidak terjadi tanpa kondisi tambahan: administrator WordPress harus memberikan capability settings__edit kepada agen atau custom role LatePoint, dan akun customer baru harus didaftarkan melalui LatePoint setelah perubahan setting jahat tersimpan.
Konteks dan Referensi
Referensi resmi yang dapat ditinjau:
- Wordfence Threat Intel:
https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve - WordPress Plugin Trac:
settings_controller.php#L469,settings_helper.php#L754,customer_helper.php#L297,settings_helper.php#L953 - Changeset:
https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint
Dari perspektif pertahanan, kasus ini menekankan pentingnya validasi server-side dan prinsip hak akses minimum untuk capability plugin, bukan hanya pembatasan pada antarmuka pengguna.
Mitigasi dan Perbaikan
- Segera perbarui Appointment Booking Plugin – LatePoint ke versi yang menyediakan patch resmi dari vendor. Karena semua versi hingga 5.7.3 tercatat terdampak, versi 5.7.3 atau lebih lama tidak dapat dianggap aman.
- Jika patch resmi belum tersedia atau belum dapat diterapkan, nonaktifkan sementara plugin LatePoint sampai pembaruan yang aman tersedia.
- Tinjau peran LatePoint dan cabut capability settings__edit dari agen atau custom role yang tidak benar-benar membutuhkannya; batasi ke administrator tepercaya.
- Audit akun WordPress untuk menemukan akun administrator yang tidak dikenal, terutama customer LatePoint yang mendaftar setelah perubahan setting default_wp_role_for_customer tidak sah.
- Pantau log perubahan setting LatePoint dan pendaftaran customer baru; jika ada indikasi penyalahgunaan, lakukan investigasi dan tindakan pemulihan sesuai prosedur insiden.
Referensi Resmi
- CVE-2026-104766 — CVE Program (cve.org)
- https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint
Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.
Pertanyaan yang Sering Diajukan (FAQ)
Apa itu CVE-2026-104766?
Seberapa parah kerentanan ini?
Siapa yang dapat memicu kerentanan?
Apakah dropdown UI mencegah perubahan role?
Apa dampak jika berhasil dieksploitasi?
Apakah semua instalasi LatePoint otomatis terdampak?
English Version — CVE-2026-104766: LatePoint Privilege Escalation Vulnerability
Quick Summary
- CVE-2026-104766 is a HIGH 8.8 privilege escalation vulnerability in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress up to version 5.7.3.
- The OsSettingsController::update() handler processes attacker-supplied settings parameters without an allowlist, and OsSettingsHelper::prepare_value() does not validate the role before saving default_wp_role_for_customer.
- As a result, LatePoint customer accounts that register after the setting change can be created with WordPress administrator privileges if an administrator has granted the settings__edit capability to an agent or custom role.
Vulnerability Summary
CVE-2026-104766 is a privilege escalation vulnerability in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. According to the official description, the plugin is vulnerable in all versions up to, and including, 5.7.3. The severity is rated HIGH 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the category CWE-269 Improper Privilege Management. CVE publication: 2026-10-10T05:30:57.307Z.
The CNA title highlights the parameter settings[default_wp_role_for_customer] as the authenticated privilege escalation path.
Technical Impact
The vulnerability occurs because the OsSettingsController::update() handler iterates over the attacker-supplied settings parameter without an allowlist of permitted setting names or values. In addition, OsSettingsHelper::prepare_value() does not perform role allowlist validation before saving the default_wp_role_for_customer setting. The role restriction exists only in the UI dropdown and is never enforced server-side.
As a result, an authenticated attacker with a LatePoint role that has the settings__edit capability, such as an agent or custom role, can overwrite the default WordPress role for new customers to administrator. Once the malicious setting is saved, any LatePoint customer account that self-registers can be created with full WordPress administrator rights.
Affected Products
Vendor: latepoint. Product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Affected version: 0 (affected), covering all versions up to, and including, 5.7.3.
Exploitation does not occur without additional conditions: a WordPress administrator must grant the settings__edit capability to a LatePoint agent or custom role, and a new customer account must be registered through LatePoint after the malicious setting change is saved.
Context and References
Official references for review:
- Wordfence Threat Intel:
https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cve - WordPress Plugin Trac:
settings_controller.php#L469,settings_helper.php#L754,customer_helper.php#L297,settings_helper.php#L953 - Changeset:
https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint
From a defense perspective, this case emphasizes the importance of server-side validation and the principle of least privilege for plugin capabilities, not merely restrictions at the user interface.
Mitigation
- Immediately update Appointment Booking Plugin – LatePoint to a version that provides the vendor's official patch. Because all versions up to 5.7.3 are recorded as affected, version 5.7.3 or older cannot be considered safe.
- If an official patch is not yet available or cannot yet be applied, temporarily disable the LatePoint plugin until a secure update is available.
- Review LatePoint roles and revoke the settings__edit capability from agents or custom roles that do not truly need it; restrict it to trusted administrators.
- Audit WordPress accounts to find unknown administrator accounts, especially LatePoint customers who registered after an unauthorized default_wp_role_for_customer setting change.
- Monitor LatePoint setting change logs and new customer registrations; if there is any indication of abuse, investigate and take remediation actions in accordance with incident procedures.
Komentar
Posting Komentar