PatchSiren

Pinpoint Booking System CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Pinpoint Booking System CVE published 2026-08-10

CVE-2026-15229

The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation. This vulnerability affects WordPress sites using the Pinpoint Booking System plugin, particularly those with sens [truncated]