CVE-2026-15229 Overview
CVE-2026-15229 affects the Pinpoint Booking System WordPress plugin through version 2.9.9.7.1. The plugin fails to validate booking prices on the server side. Unauthenticated attackers can create bookings at arbitrary prices, including zero. By selecting a specific payment method, an attacker can obtain an instantly-approved reservation without paying the intended amount.
The flaw stems from broken authorization logic classified under [CWE-863]. The vulnerability requires no authentication and can be triggered remotely over the network, making it accessible to any visitor of an affected site.
Critical Impact
Unauthenticated attackers can create fully approved bookings at any price, including zero, resulting in direct revenue loss for site operators.
Affected Products
- Pinpoint Booking System WordPress plugin versions through 2.9.9.7.1
- WordPress sites using the plugin with online payment methods enabled
- All hosting environments running the affected plugin version
Discovery Timeline
- 2026-08-10 - CVE-2026-15229 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-15229
Vulnerability Analysis
The Pinpoint Booking System plugin processes reservation requests without verifying the submitted price against server-side data. The client submits booking parameters, including the price, and the plugin accepts these values without recalculating them from authoritative product or availability records.
This pattern is a classic business logic flaw where trust boundaries are misplaced. The server treats client-supplied pricing data as authoritative rather than deriving the price from booking dates, resource IDs, and configured rates stored in the database.
Combined with a specific payment method that marks reservations as approved on submission, the flaw enables an attacker to bypass the entire payment workflow. The result is a confirmed booking record that consumes availability and generates confirmation notifications.
Root Cause
The root cause is missing server-side authorization and validation of pricing data [CWE-863]. The plugin does not enforce that only the backend can determine the final price for a booking. It also does not restrict which payment methods produce an instantly-approved state relative to actual payment confirmation.
Attack Vector
An unauthenticated remote attacker submits a crafted booking request to the plugin's public endpoint. The attacker manipulates the price parameter to zero or any arbitrary value. The attacker then selects a payment method configured to auto-approve reservations. The booking is created and marked confirmed without a legitimate transaction.
Refer to the WPScan Vulnerability Advisory for technical specifics on the vulnerable request flow.
Detection Methods for CVE-2026-15229
Indicators of Compromise
- Booking records with prices of zero or values inconsistent with published rates
- Reservations marked approved without matching payment gateway transaction records
- Repeated POST requests to the plugin's booking submission endpoint from a single IP or user agent
- Confirmation emails sent for bookings that lack corresponding financial records
Detection Strategies
- Audit the WordPress database wp_dbi_bookings and related tables for entries with anomalous price fields
- Correlate booking timestamps with payment processor logs to identify reservations lacking a paired transaction
- Deploy web application firewall rules that inspect booking submission parameters for out-of-range price values
Monitoring Recommendations
- Monitor WordPress access logs for POST requests targeting Pinpoint Booking endpoints with unusual parameter values
- Alert on rapid booking creation from the same source address
- Track daily reconciliation reports comparing bookings created against payments received
How to Mitigate CVE-2026-15229
Immediate Actions Required
- Disable the Pinpoint Booking System plugin until an updated version is available
- Disable auto-approving payment methods in the plugin configuration if the plugin must remain active
- Review all bookings created since installation for evidence of price manipulation
- Contact affected customers and cancel fraudulent reservations to reclaim availability
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. The vulnerability affects all versions through 2.9.9.7.1. Administrators should monitor the WPScan Vulnerability Advisory and the plugin's WordPress.org page for a security release.
Workarounds
- Restrict access to the booking endpoint using IP allowlists or authentication gateways where feasible
- Deploy a web application firewall rule that rejects booking submissions with prices below configured minimum thresholds
- Require manual approval for all reservations by disabling instant-approval payment methods in the plugin settings
- Implement server-side reconciliation that voids bookings without matching payment confirmations within a short window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
