Executive brief
The Pinpoint Booking System WordPress plugin fails to validate booking prices on the server side, allowing unauthenticated attackers to create reservations at any price, including zero, and immediately approve them by selecting specific payment methods. This bypasses normal revenue controls and allows attackers to book services without paying the intended amount.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the booking creation AJAX handler (dopbsp_reservations_book). The plugin accepts client-supplied price values without server-side validation, allowing attackers to submit arbitrary prices in cart_data parameters. When the WooCommerce payment method is selected, manipulated bookings are automatically set to "approved" status despite the incorrect price. The vulnerability requires network access to the WordPress admin-ajax.php endpoint but no authentication; it affects published booking calendars in their normal operating state.
Affected products
- Pinpoint Booking System through 2.9.9.7.1
Timeline
- 2026-08-06: disclosed
- 2026-08-10: advisory