Pinpoint Booking System field filtering permits administrator SQL injection
Pinpoint Booking System – Version 2 through 2.9.9.6.9 inserts the administrator-controlled field parameter into a database query without sufficient escaping or query preparation. An Administrator can obtain the required nonce from any plugin administration page loaded under manage_options, submit crafted SQL through field, and use the resulting blind SQL-injection behavior to infer or extract information available to the WordPress database account. The published record identifies the backend calendar handler but does not disclose the request action or the complete query.
- Component
- Pinpoint Booking System – Version 2
- Plugin slug
booking-system- Affected
- <= 2.9.9.6.9
- Safe version
- See mitigation notes
- Published
- Aug 01, 2026
This CVE was published Aug 01, 2026 and is one of 11 known issues for this plugin.
Update, patch or deactivate.
No fixed public release is identified for Pinpoint Booking System – Version 2 through 2.9.9.6.9. Limit Administrator access to trusted users and deactivate the affected plugin when the site's risk profile warrants it until the vendor publishes a corrected release. If misuse is suspected, review plugin administration and database logs for crafted field values or time-delay probes and rotate exposed credentials or secrets.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N