Pinpoint Booking System <= 2.9.9.6.9 管理后台认证SQL注入漏洞 (CVE-2026-15403)

漏洞概述 漏洞名称: Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter CVE ID: CVE-2026-15403 CVSS评分: 4.9 (Medium) 公开日期: July 31, 2026 最后更新日期: August 1, 2026 研究人员: Wordfence PRISM - Wordfence 影响范围 软件类型: Plugin 软件名称: booking-system (view on wordpress.org) 受影响版本: <= 2.9.9.6.9 修复方案 补丁状态: 无已知补丁可用 建议措施: 请深入审查漏洞详情，并根据您组织的安全容忍度采取缓解措施。最好卸载受影响的软件并寻找替代品。 漏洞描述 Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. 参考链接 plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 近期相关漏洞 其他信息 版权信息: 2012-2026 Defiant Inc. All Rights Reserved 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 支持服务: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. 相关链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Products Support News About Stay Updated 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 文档 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 文档 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 文档 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 文档 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 文档 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 邮箱: you@example.com 条款: By checking this box I agree to the terms of service and privacy policy. 底部链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 Facebook Twitter LinkedIn Instagram 版权 © 2012-2026 Defiant Inc. All Rights Reserved 其他 Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Pinpoint Booking System <= 2.9.9.6.9 管理后台认证SQL注入漏洞 (CVE-2026-15403)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Pinpoint Booking System <= 2.9.9.6.9 管理后台认证SQL注入漏洞 (CVE-2026-15403)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！