What’s Vulnerable › Vulnerabilities
CVE-2026-15229: Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-10 · updated 2026-08-26
- Weakness: CWE-863
Description
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
Affected products
- dotonpaper Pinpoint Booking System – Version 2: through 2.9.9.7.1
References
Get alerted when CVE-2026-15229 or the next vulnerability affects your stack