CVE-2026-15229
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
Risk Assessment
The risk includes financial losses for property owners, potential abuse and bypass of the payment process, which could lead to unauthorized bookings and system integrity compromise.
Recommendation
It is recommended to upgrade the plugin to a patched version and implement server-side price validation, as well as monitor bookings for anomalies.
Original NVD description (English source)
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.