CVE-2026-12128: Pinpoint Booking System Unauthenticated Price Manipulation Vulnerability

Vulnerability Overview Vulnerability Name: Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation Leading to Price Manipulation CVE ID: CVE-2026-12128 CVSS Score: 5.3 (Medium) Release Date: August 14, 2026 Last Updated: August 15, 2026 Researchers: Enrico Marcolini, Claudio Marchesini (Dettonari) - Dottor Marc Cybersecurity Affected Scope Affected Versions: Pinpoint Booking System <= 2.9.9.6.8 Software Type: WordPress Plugin Software Slug: booking-system Remediation Patch Status: No known patch available Recommended Actions: Please review the vulnerability details in depth and implement mitigations based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Vulnerability Description The Pinpoint Booking System version 2 plugin for WordPress contains a price manipulation vulnerability exploitable across all versions, including 2.9.9.6.8, via the parameter. This vulnerability arises because the AJAX action is registered under , lacking authentication, notification validation, and server-side price recomputation. An attacker can control the POST parameter to bypass price validation in the calendar settings, directly injecting attacker-supplied values. This allows overwriting the checkout price in WooCommerce, enabling the purchase of any bookable product linked to the booking calendar at an arbitrary price. References plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Recent Vulnerabilities: The page lists other recently discovered vulnerabilities in Pinpoint Booking System version 2, including SQL Injection, Missing Authorization, and Cross-Site Request Forgery (CSRF). Disclaimer: The bottom of the page contains copyright notices and terms of use. Contact Information Technical Support: 9 AM - 8 PM ET, 6 AM - 5 PM PT, and 2 PM - 1 AM UTC/GMT (excluding weekends and holidays) Response Time: 365 days a year, 1-hour response time Footer Information Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe: Sign up for news and updates from our panel of experienced security professionals. Copyright Information © 2012-2026 Defent Inc. All Rights Reserved Miscellaneous Disclaimer: The bottom of the page contains copyright notices and terms of use. Summary The Pinpoint Booking System version 2 plugin contains an unauthenticated improper input validation vulnerability that may lead to price manipulation. Users are advised to review the vulnerability details promptly and take appropriate action, such as uninstalling the affected software or seeking alternatives.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-12128: Pinpoint Booking System Unauthenticated Price Manipulation Vulnerability

More from this source