WordPress security changelog
MEDIUM CVE-2026-12128 Deferred

Pinpoint Booking cart_data permits unauthenticated WooCommerce price manipulation

Pinpoint Booking System through 2.9.9.6.8 exposes dopbsp_woocommerce_add_to_cart through wp_ajax_nopriv without authentication or a nonce. The update handler trusts price_total from the cart_data POST value and stores it directly; woocommerce_before_calculate_totals later reads that value and calls set_price() without recalculating from calendar settings. An unauthenticated buyer can therefore purchase a calendar-linked product at an arbitrary chosen price. Other cart_data fields are not disclosed.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Pinpoint Booking System – Version 2
Plugin slug
booking-system
Affected
<= 2.9.9.6.8
Safe version
See mitigation notes
Published
Aug 15, 2026
Weakness
CWE-20 — Improper Input Validation

This CVE was published Aug 15, 2026 and is one of 13 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is identified in the authoritative record. Update when a confirmed patch is available; until then, disable the WooCommerce booking integration when warranted and reconcile booking prices, orders, payments, and fulfillment.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources