Description (CNA)
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dotonpaper / Pinpoint Booking System – Version 2 | affected 0 through 2.9.9.6.8 |
CWE
CWE-20
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e6faf2b7-52e2-4656-9171-4ee17352ed1e?source=cve
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.8/addons/woocommerce/includes/class-woocommerce-cart.php#L293
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.8/addons/woocommerce/includes/class-woocommerce-cart.php#L90
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.8/addons/woocommerce/dopbsp-woocommerce.php#L141
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.8/addons/woocommerce/includes/class-woocommerce-cart.php#L125
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/woocommerce/includes/class-woocommerce-cart.php#L293
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/woocommerce/includes/class-woocommerce-cart.php#L90
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/woocommerce/dopbsp-woocommerce.php#L141
- https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/woocommerce/includes/class-woocommerce-cart.php#L125
ADP enrichment
No English description supplied.
No references supplied.