What is the CVSS score of CVE-2026-15229?

CVE-2026-15229 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-15229?

Yes, a public proof-of-concept exploit is available for CVE-2026-15229. Prioritise patching immediately. EPSS: 0.1%.

Pinpoint Booking System CVE-2026-15229

EUVD-2026-55008 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-10 WPScan

GHSA-2jwj-8g7h-f5p5

WordPress Authentication Bypass Pinpoint Booking System Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no authentication or interaction needed; integrity impact is limited to fraudulent booking records with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 15:26 vuln.today

CVSS changed

Aug 12, 2026 - 15:22 NVD

5.3 (MEDIUM)

CVE Published

Aug 10, 2026 - 06:00 cve.org

MEDIUM 5.3

CVE Published

Aug 10, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.

AnalysisAI

Pinpoint Booking System WordPress plugin (all versions through 2.9.9.6.9) accepts client-supplied booking prices without any server-side validation, allowing unauthenticated visitors to create reservations at arbitrary prices including zero. By selecting a payment method that triggers instant approval, an attacker can obtain a confirmed, cost-free booking - a direct financial impact on site operators. Publicly available exploit code exists via WPScan, though EPSS at 0.14% (3rd percentile) indicates minimal observed automated exploitation at time of analysis; no CISA KEV listing is present.

Technical ContextAI

This is a WordPress plugin business logic flaw rooted in CWE-863 (Incorrect Authorization). The plugin's booking workflow processes price data submitted by the client browser without re-validating it against the server-side configured price schedule. Any parameter carrying the booking amount is trusted as-is, violating the principle that pricing authority must reside exclusively on the server. The CPE cpe:2.3:a:unknown:pinpoint_booking_system:*:*:*:*:*:*:*:* confirms all versions up to 2.9.9.6.9 are affected. The vulnerability is compounded by at least one payment method that grants instant reservation approval, allowing the fraudulent price to be confirmed without any further verification step.

RemediationAI

No specific patched version is confirmed in the available data; site administrators should consult the WPScan advisory at https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/ for the latest vendor patch status and upgrade as soon as a fixed release is available. As an immediate compensating control, disable any instant-approval payment methods within the plugin's configuration and switch to manual booking approval, which breaks the direct exploitation path by requiring an operator to confirm each reservation - though note this increases administrative overhead. Temporarily deactivating the plugin entirely is the most effective mitigation if bookings can be handled via an alternative channel. Do not rely on client-side price controls as a substitute for server-side validation.