CVE-2026-15229 Pinpoint Booking System CVE debrief

Who should care

Administrators of WordPress sites using the Pinpoint Booking System plugin should be aware of this vulnerability and take steps to mitigate it. They should review their system configurations, validate and sanitize user input for booking prices, and consider implementing additional security measures to prevent unauthorized access. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize validation and mitigation efforts.

Technical summary

The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation. This vulnerability is caused by a lack of server-side validation of booking prices, which allows attackers to manipulate the booking process and bypass security measures. The vulnerability has significant technical implications, including the potential for unauthorized access and data breaches.

Defensive priority

Defenders should prioritize validating and sanitizing user input, particularly for sensitive data such as booking prices, and consider implementing additional security measures to prevent unauthorized access.

Recommended defensive actions

• Validate and sanitize user input for booking prices
• Implement additional security measures to prevent unauthorized access
• Monitor for suspicious activity related to booking prices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this vulnerability is limited. Further verification is needed to determine the full scope of the vulnerability and affected systems. Defenders should verify the presence of the Pinpoint Booking System WordPress plugin version 2.9.9.6.9 or earlier, review server-side validation of booking prices, and assess potential impact on their systems.

Official resources