Blind SQL Injection Vulnerability in Pinpoint Booking System Plugin for WordPress

CVE-2026-15403

What is CVE-2026-15403?

The Pinpoint Booking System plugin for WordPress is susceptible to blind SQL injection attacks via the 'field' parameter due to inadequate escaping of user-supplied input and insufficient preparation of SQL queries. Authenticated attackers with administrator-level access can manipulate existing queries by injecting additional SQL commands, potentially allowing exposure of sensitive database information. Since the nonce associated with the vulnerable endpoint is made available on all plugin admin pages for users with manage_options capabilities, attackers can easily access it, increasing the risk of exploitation.

References