Pinpoint Booking System <= 2.9.9.6.9 Authenticated SQL Injection via 'field' Parameter (CVE-2026-15403)

Vulnerability Overview Vulnerability Name: Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter CVE ID: CVE-2026-15403 CVSS Score: 4.9 (Medium) Publication Date: July 31, 2026 Last Update Date: August 1, 2026 Researchers: Wordfence PRISM - Wordfence Affected Products Software Type: Plugin Software Name: booking-system (view on wordpress.org) Affected Versions: <= 2.9.9.6.9 Remediation Patch Status: No known patch available Recommended Actions: Please review the vulnerability details in depth and implement mitigation measures based on your organization's security tolerance. It is best to uninstall the affected software and look for alternatives. Vulnerability Description Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Related Recent Vulnerabilities Additional Information Copyright: 2012-2026 Defiant Inc. All Rights Reserved Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Support Services: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Related Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Subscribe Email: you@example.com Terms: By checking this box I agree to the terms of service and privacy policy. Footer Links Products Support News About Stay Updated Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Email: you@example.com Terms: By checking this box I agree to the terms of service and privacy policy. Footer Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Email: you@example.com Terms: By checking this box I agree to the terms of service and privacy policy. Footer Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Email: you@example.com Terms: By checking this box I agree to the terms of service and privacy policy. Footer Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligence Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Documentation Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Subscribe Email: you@example.com Terms: By checking this box I agree to the terms of service and privacy policy. Footer Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Instagram Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Intelligenc

Goal Reached Thanks to every supporter — we hit 100%!

Pinpoint Booking System <= 2.9.9.6.9 Authenticated SQL Injection via 'field' Parameter (CVE-2026-15403)

More from this source