← CVE Intelligence

CVE-2026-15229

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation PUBLISHED

Description (CNA)

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.

Affected (CNA)

Vendor / productVersions
Unknown / Pinpoint Booking Systemaffected 0 through 2.9.9.7.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.