medium5.3
CVE-2026-15229
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create…
Impact
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
Affected products
| Product | Affected versions |
|---|---|
| Pinpoint Booking System WordPress Plugin | through 2.9.9.7.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.