Pinpoint Booking System vulnerabilities
3 known CVE vulnerabilities in Pinpoint Booking System, translated and rated.
- CVE-2026-12128Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.
- CVE-2026-15403Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.9 has a blind SQL Injection vulnerability via the 'field' parameter due to insufficient escaping and query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive data from the database.
- CVE-2026-39678Medium
Missing authorization in the Pinpoint Booking System plugin (booking-system) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 2.9.9.6.5 inclusive.