{"metadata": {"vulnerability": "CVE-2026-104766", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-02T12:39:39.043Z", "date_only": false, "value": "2026-10-02T12:39:39.043Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104766", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T12:55:22Z", "date_only": false, "value": "2026-10-02T12:55:22.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104766", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-09T17:19:05Z", "date_only": false, "value": "2026-10-09T17:19:05.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104766", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-10T05:30:57.307Z", "date_only": false, "value": "2026-10-10T05:30:57.307Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104766", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T05:30:57.307Z", "date_only": false, "value": "2026-10-10T05:30:57.307Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104766", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T05:45:08.190Z", "date_only": false, "value": "2026-10-10T05:45:08.190156Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117415025553587770", "record": "CVE-2026-104766", "field": "creation_timestamp", "uuid": "9d98b74f-f850-4bf7-ad83-29d8dc25c4b1", "content": "CVE-2026-104766 Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter The Appointment Booking Plugin \u2013 LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting \u2014 a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit` capability (such as an agent or custom role) to overwrite the default WordPress role for new customers with `administrator`, causing any subsequently self-registered LatePoint customer account to be created with full WordPress administrator privileges. Exploitation requires that a WordPress administrator has granted the `settings__edit` capability to a LatePoint agent or custom role, and that a new customer account is registered through LatePoint after the malicious setting change is persisted.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104766https://www.wordfence.com/threat-intel/vulnerabilities/id/38870e14-2e8f-4281-adb6-4be3b1d3d2ce?source=cvehttps://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/controllers/settings_controller.php#L469https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L754https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/customer_helper.php#L297https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.3/lib/helpers/settings_helper.php#L953https://plugins.trac.wordpress.org/changeset?reponame=&old=3728691%40latepoint&new=3728691%40latepoint#wordpress #latepoint #AppointmentBookingPlugin\u2013LatePoint|Calendar&SchedulingforWordPress#CVE_2026_104766#bot", "url": "https://infosec.exchange/users/cve/statuses/117415025553587770"}, {"timestamp": "2026-10-10T06:16:40Z", "date_only": false, "value": "2026-10-10T06:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H977-FPPF-XGG7", "record": "GHSA-H977-FPPF-XGG7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T06:16:40.007Z", "date_only": false, "value": "2026-10-10T06:16:40.007", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104766", "record": "FKIE_CVE-2026-104766", "field": "published"}, {"timestamp": "2026-10-10T06:30:59Z", "date_only": false, "value": "2026-10-10T06:30:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H977-FPPF-XGG7", "record": "GHSA-H977-FPPF-XGG7", "field": "published"}, {"timestamp": "2026-10-10T06:30:59Z", "date_only": false, "value": "2026-10-10T06:30:59Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H977-FPPF-XGG7", "record": "GHSA-H977-FPPF-XGG7", "field": "modified"}, {"timestamp": "2026-10-11T16:38:26.953Z", "date_only": false, "value": "2026-10-11T16:38:26.953919Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104766", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T16:38:26.953Z", "date_only": false, "value": "2026-10-11T16:38:26.953919Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104766", "record": "FKIE_CVE-2026-104766", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T16:55:18.205Z", "date_only": false, "value": "2026-10-11T16:55:18.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104766", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T16:55:18.205Z", "date_only": false, "value": "2026-10-11T16:55:18.205Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104766", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:30:21.620Z", "date_only": false, "value": "2026-10-13T13:30:21.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104766", "record": "FKIE_CVE-2026-104766", "field": "lastModified"}]}