LatePoint flaw CVE-2026-13228 lets staff hijack the site; update to 5.6.4

A serious site-takeover vulnerability has been found in "LatePoint," a popular WordPress plugin used by hair salons, clinics, and professional services to automate appointment booking. Tracked as CVE-2026-13228, it carries a severity of 8.8 out of 10 ("High").

The flaw lets an account with only the limited "agent" role — meant for booking-site staff — hijack the site owner's administrator (top-level) account entirely. The developer released a fixed version, "5.6.4," on June 30, 2026. LatePoint is used on more than 100,000 sites worldwide, so anyone running 5.6.3 or earlier on a booking site needs to update right away.

Who would exploit this, and why

This is not something just anyone can pull off from the outside. The people who can exploit it are those who hold a staff "agent" account on the booking site, or an attacker who has stolen a staff member's login. That covers part-time front-desk workers, contractors hired to manage bookings, or even a former employee whose account was never deactivated.

What such a person can do is rewrite the site owner's administrator email address to one they control, then use the password-reset feature to seize the entire administrator account. Staff who should only be able to check bookings and handle customers can instead grab the site's highest privileges.

The damage to the victim is severe. Shops and clinics running the booking site risk losing customer personal data (names, contact details, booking history), payment-service integration settings, and the site's contents all at once. For the ordinary people who booked appointments, it can mean their personal data falling into a stranger's hands and secondary harm such as fake booking pages or phishing (scam sites disguised as the real one). That is why the update described below should be your top priority.

What LatePoint is, and who "agents" are

LatePoint is a plugin (add-on software) that bolts appointment-booking features onto a WordPress site. It is widely used by businesses that take time-slot bookings: hair and nail salons, massage clinics, dental offices, counseling, and professional consultations. According to the vendor, over 21,000 businesses use it, and its active-install count in the official WordPress directory has reached more than 100,000.

The key to understanding this issue is LatePoint's concept of "roles." LatePoint has three main roles: the customer who books, the agent (staff) who provides the service, and the administrator who manages the whole site. An agent is a "person who owns booking slots," such as a stylist or practitioner; they can view their own schedule and manage their assigned customers, but are not granted the power to change site settings. Agents are internal accounts issued by the administrator — not something an outside third party can obtain on their own.

In other words, LatePoint is designed on the premise that "staff only do booking work and cannot touch the site's foundations." This vulnerability breaks that premise.

What actually happens: inside the flaw

At the center of the problem is the internal routine that creates and updates customer records (a function called create_or_update()). According to the U.S. National Institute of Standards and Technology (NIST) vulnerability database, two flaws overlapped here.

The first is an "insecure reference" (technically an IDOR: if you pass an ID pointing to someone else's data, the system acts on it without verifying ownership). When an agent updated a customer record, the check on "which customer are you rewriting" was too loose — allowing them to target not just customers outside their assignment, but even the customer record linked to an administrator account. The second is that the "do you actually have permission for this action?" role check was missing during that operation.

Combine the two, and the attack path is this: using agent privileges, rewrite the email address registered to the administrator account to an address the attacker controls. Then use the "reset password" feature, and the reset link is delivered to the attacker's now-substituted address. All that is left is to set a new password and log in — entering the site as an administrator without ever passing a role check. Hijacking an administrator by starting from an email-address change closely mirrors the takeover case in the WordPress plugin "Kirki" we reported earlier.

Once a WordPress administrator account is stolen, the attacker can do virtually anything: tamper with posts and pages, add rogue accounts, inject malicious code, even manipulate files on the server. The danger of stealing an administrator from a low-privilege role has come up repeatedly, as in the administrator-takeover flaw in the membership plugin "Ultimate Member" and the "WPCode" flaw that let an editor run arbitrary code.

How dangerous is it, really? Read the conditions correctly

The CVSS severity score is 8.8, classed as "High." A successful takeover is about as bad as it gets — but before you panic over the number, understand the preconditions precisely.

To exploit this, you need agent (staff) login credentials in advance. The severity breakdown lists "privileges required: low (but logged in)," meaning this is not a type you can trigger from outside in one shot without logging in. If you see coverage claiming "anyone can take over with no authentication," that is inaccurate.

That said, "it needs a login, so it's safe" does not hold. In reality there are plenty of ways agent privileges end up in a third party's hands: insider actions by staff, leftover accounts of former employees, poor management of contractor accounts, and phishing to steal staff logins. The more staff a shop chain employs, or the more a business outsources booking management, the more realistic the risk. Write-ups of past similar flaws also cite internal staff and outsourced personnel as the main expected attackers.

Is my site at risk? A version-by-version guide

First, check the LatePoint version in your dashboard's "Plugins" list. The table below helps you judge your situation.

If you run a solo site with no registered staff, the urgency is lower, since there is no "agent" entry point to exploit. Even so, as explained below, LatePoint keeps producing flaws of the same family, so updating is the safe choice — including for sites that plan to add staff later.

An engineer's view: LatePoint keeps patching the same hole

This is the point we most want to make. CVE-2026-13228 is not a one-off accident. LatePoint has repeatedly patched the same family of "escalate from staff to administrator" flaws over the past several months. Lined up chronologically, the repetition is stark.

You can see the same "staff-to-administrator escalation" surfacing again and again across versions. Why does this happen? To an engineer's eye, this points less to individual bugs and more to weakness in the privilege design itself. LatePoint maintains its own "customer" and "agent" user system, separate from WordPress's own user accounts. Somewhere in the code that links this custom system to WordPress's native accounts, the check for "do you really have permission for this action?" is easy to omit.

There are multiple operation entry points (updating an email address, linking a customer to a user account, resetting a password), and each one has to be written with its permission check done correctly. Plug one hole and another entry point remains — which is why flaws of the same family keep resurfacing. This is not unique to one plugin; it is a weakness commonly shared by "add-on software that bolts on its own permission system." In June, several popular WordPress plugins had vulnerabilities disclosed in quick succession, and the pattern is the same: the more add-ons you install, the more attack entry points you create.

The practical lesson is clear. For a plugin that habitually ships flaws of the same family, you should not merely update to the latest version — you should also enable auto-updates. The realistic assumption is that the next CVE is only a matter of time.

Has it been exploited?

As of now, there are no confirmed reports of this vulnerability being used in real attacks. CVE-2026-13228 is also not listed in the "Known Exploited Vulnerabilities (KEV)" catalog published by the U.S. cybersecurity agency CISA.

However, the vulnerability details and the fix are public in the official changelog, and comparing the code before and after the fix makes it far from difficult to reconstruct an attack. The period right after a fix is released is exactly when attacks based on analyzing that diff tend to begin. "Not yet attacked" is not a reason to skip the update.

What to do now

The top priority is to update LatePoint to the fixed version 5.6.4 or later. Open "Plugins" in the WordPress dashboard, and if an update notice appears for LatePoint, you can update on the spot. According to the developer, 5.6.4 was fixed in response to reports from the security firms Wordfence and Patchstack.

Beyond updating, it is safe to review the following while you are at it. First, delete agent (staff) accounts you no longer need. Check whether accounts of former employees or ended contractors are still lying around. Second, strengthen staff-account passwords and enable two-step verification. If agent privileges cannot be stolen, this flaw's entry point is closed. Also check whether your administrator account's email address has received any unfamiliar change or reset notifications. If you notice anything suspicious, reset the password and review the login history.

Summary

CVE-2026-13228 is a vulnerability that lets a staff account in the LatePoint booking plugin seize the site's administrator privileges wholesale. The severity is a high CVSS 8.8, but exploitation requires staff privileges in advance. It is not a "anyone, one shot, from outside" type — yet it can genuinely occur via insider actions or a stolen staff account.

What you cannot overlook is that LatePoint has repeatedly patched escalation flaws of the same family. Rather than treating this as a one-time issue and calling it done after updating, we recommend switching to an operation that enables auto-updates and cleans up unnecessary staff accounts. More than 100,000 shop and clinic booking sites are affected. Start by checking, right now, whether your LatePoint is on 5.6.4 or later.

References

• ▸NVD - CVE-2026-13228 Detail (U.S. NIST)
• ▸LatePoint - WordPress plugin page (changelog / 5.6.4)
• ▸LatePoint official site
• ▸SentinelOne - CVE-2026-1566 (earlier similar flaw / agent role explained)
• ▸Freshy - LatePoint CVE-2026-6741 Security Bulletin
• ▸CIRCL - CVE-2026-8176 (LatePoint 5.5.1 or earlier escalation)