CVE-2026-39678
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing authorization in the Pinpoint Booking System plugin (booking-system) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 2.9.9.6.5 inclusive.
Risk Assessment
Unauthorized users may gain access to functions or data that should be protected, potentially leading to confidentiality or integrity breaches.
Recommendation
It is recommended to update the Pinpoint Booking System plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Pinpoint Booking System
See all- CVE-2026-12128Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.
- CVE-2026-15403Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.9 has a blind SQL Injection vulnerability via the 'field' parameter due to insufficient escaping and query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive data from the database.
Original NVD description (English source)
Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.6.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS