CVE-2026-39678 DOTonPAPER CVE debrief

Who should care

Users of the DOTonPAPER Pinpoint Booking System booking-system plugin, especially those using versions from n/a through <= 2.9.9.6.5, should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The CVE-2026-39678 vulnerability is caused by a Missing Authorization issue in the DOTonPAPER Pinpoint Booking System booking-system plugin. This allows for Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. It affects versions from n/a through <= 2.9.9.6.5 of the plugin.

Defensive priority

Medium priority should be given to updating the DOTonPAPER Pinpoint Booking System booking-system plugin to a version that addresses this vulnerability.

Recommended defensive actions

• Inventory and verify the version of the DOTonPAPER Pinpoint Booking System booking-system plugin in use.
• Apply updates or patches provided by the vendor to address the vulnerability.
• Implement compensating controls, such as monitoring and access restrictions, if immediate updates are not possible.
• Review and adjust access control configurations to prevent exploitation.

Evidence notes

The CVE record was published on 2026-04-08T09:16:39.487Z and has not been modified since. The NVD entry is currently Deferred. The vulnerability details are based on information from official sources, including CVE.org and the NVD.

Official resources