CVE-2026-104766

Summary

The LatePoint WordPress plugin has a privilege escalation vulnerability where authenticated users with the 'settings__edit' capability can change the default WordPress role for new customers to administrator, allowing self-registered customers to gain full admin privileges. This affects all versions up to and including 5.7.3.

Exploitability

Exploitation requires an authenticated attacker with 'settings__edit' capability and a WordPress admin to grant this capability to a LatePoint agent or custom role, followed by a new customer registration through LatePoint after the setting change is persisted.

Blast radius

The impact could be significant as any newly self-registered customer would gain full WordPress administrator privileges, potentially allowing attackers to completely compromise the WordPress site and its underlying infrastructure.

Detection

Monitor for unusual changes to the 'default_wp_role_for_customer' setting in the wp_options table, particularly when made by users with 'settings__edit' capability but without proper authorization.

Prioritized remediation

Upgrade to version 5.7.4 or later to address this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.