{"id":"CVE-2026-15229","state":"PUBLISHED","title":"Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation","description":"The Pinpoint Booking System  WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.","publishedAt":"2026-08-10T06:00:17.447Z","updatedAt":"2026-08-12T15:05:19.077Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Pinpoint Booking System"],"affected":[{"vendor":"Unknown","product":"Pinpoint Booking System","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.9.9.7.1","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/15xxx/CVE-2026-15229.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-15229","state":"PUBLISHED","datePublished":"2026-08-10T06:00:17.447Z","dateUpdated":"2026-08-12T15:05:19.077Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-07-09T11:07:35.406Z"},"containers":{"cna":{"title":"Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation","descriptions":[{"lang":"en","value":"The Pinpoint Booking System  WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation."}],"affected":[{"vendor":"Unknown","product":"Pinpoint Booking System","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.9.9.7.1","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-08-12T12:04:27.087Z"},"credits":[{"lang":"en","value":"Ahmed Hashim Ismael","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-12T15:05:15.872599Z","id":"CVE-2026-15229","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-12T15:05:19.077Z"}}]}}}