CVE-2026-15229

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 8th percentile

Published

2026-08-10

Updated

2026-08-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1522
• CVE-2026-15230
• CVE-2026-15217
• CVE-2026-15231
• CVE-2026-15216
• CVE-2026-15233