EUVD-2026-58843
GHSA-w46h-pcxr-j4fq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible, zero-auth endpoint; Integrity rated High because attacker has unconstrained control over transaction price values, enabling arbitrary financial fraud on any bookable product.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to Price Manipulation via the cart_data parameter in all versions up to, and including, 2.9.9.6.8. This is due to the dopbsp_woocommerce_add_to_cart AJAX action being registered via wp_ajax_nopriv_* with no authentication, no nonce verification, and no server-side recalculation of pricing - the update handler reads price_total directly from the attacker-controlled cart_data POST parameter and persists it to the database via $wpdb->insert() without validating it against the calendar's configured pricing. The woocommerce_before_calculate_totals callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to $product->set_price() without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
AnalysisAI
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary price_total value into the cart_data POST parameter. The vulnerable dopbsp_woocommerce_add_to_cart AJAX handler - registered via wp_ajax_nopriv_* with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Technical ContextAI
The plugin's WooCommerce integration add-on registers the dopbsp_woocommerce_add_to_cart action via WordPress's wp_ajax_nopriv_* hook, which makes it reachable by any unauthenticated HTTP client without a nonce or session check. The update handler in class-woocommerce-cart.php (lines ~90, 125, and 293 per reference source code) reads price_total from the attacker-controlled cart_data POST body and persists it with $wpdb->insert(), bypassing all server-side pricing logic. The woocommerce_before_calculate_totals callback then retrieves this stored value from the database and calls $product->set_price() directly, so WooCommerce's standard pricing engine never runs for these transactions. The root cause maps to CWE-20 (Improper Input Validation) - specifically the complete absence of server-side recalculation or bounds-checking of a security-relevant value accepted from untrusted POST data. Affected product per CPE: cpe:2.3:a:dotonpaper:pinpoint_booking_system_-_version_2 in all versions up to and including 2.9.9.6.8.
RemediationAI
No patched version has been independently confirmed from the available references - both the CPE data and EUVD listing indicate all versions ≤2.9.9.6.8 are affected, and no fixed release version appears in any reference. Site owners should immediately check the WordPress plugin repository for a version beyond 2.9.9.6.8 from Dotonpaper and apply it if available, and monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e6faf2b7-52e2-4656-9171-4ee17352ed1e) for patch confirmation. As a compensating control pending a patch, disabling the WooCommerce add-on component of the Pinpoint Booking System plugin eliminates the vulnerable AJAX handler entirely, with the trade-off that bookable products will no longer be purchasable through WooCommerce. Alternatively, a WAF rule blocking unauthenticated POST requests to wp-admin/admin-ajax.php where the action parameter equals dopbsp_woocommerce_add_to_cart will prevent exploitation while leaving other plugin functionality intact, though it will also block legitimate guest bookings via WooCommerce until a patch is available. Server-side enforcement of price recalculation from calendar configuration (rather than trusting POST data) is the correct long-term fix.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today