Price Manipulation Vulnerability in Pinpoint Booking System for WordPress

CVE-2026-12128

What is CVE-2026-12128?

The Pinpoint Booking System for WordPress contains a vulnerability that allows unauthenticated users to manipulate pricing for WooCommerce products. The vulnerability stems from improper handling of the cart_data parameter within the dopbsp_woocommerce_add_to_cart AJAX action. This lack of authentication and nonce verification enables attackers to submit arbitrary pricing directly via POST requests. As a result, attackers can exploit this flaw to set unauthorized prices during the checkout process, potentially allowing them to purchase bookable products at prices of their choosing. This vulnerability highlights the need for robust server-side validation and security measures to protect against unauthorized data submission.

References