CVE-2026-104766

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.7.4

Description An issue exists where the OsSettingsController::update() handler iterates over attacker-supplied settings parameters without an allowlist of permitted names or values. Additionally, the OsSettingsHelper::prepare value() function fails to perform role allowlist validation before persisting the default wp role for customer setting, as the restriction is only enforced in the UI and not on the server. This allows authenticated attackers with the settings edit capability, such as agents or custom roles, to change the default WordPress role for new customers to administrator. Consequently, any new customer account registered through the plugin will be granted full WordPress administrator privileges. This requires that an administrator has previously granted the settings edit capability to the attacker's role.

Recommendations Update to version 5.7.4 or later. Restrict the settings edit capability to only highly trusted users to minimize the risk of unauthorized setting changes.