What is the CVSS score of CVE-2026-15403?

CVE-2026-15403 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Pinpoint Booking System CVE-2026-15403

EUVD-2026-51690 MEDIUM

SQL Injection (CWE-89)

2026-08-01 Wordfence

GHSA-v59p-52gm-jwpr

WordPress SQLi Wordpress Plugin Pinpoint Booking System Version 2 Dotonpaper

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Administrator-level authentication required (PR:H); read-only SQL extraction yields C:H but no integrity or availability impact (I:N/A:N); network-reachable endpoint with no complexity beyond holding admin credentials (AV:N/AC:L).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 02:45 vuln.today

CVE Published

Aug 01, 2026 - 01:29 cve.org

MEDIUM 4.9

DescriptionCVE.org

The Pinpoint Booking System - Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator.

AnalysisAI

Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-89 (SQL Injection) arises here from insufficient escaping of the user-supplied 'field' parameter combined with the absence of prepared statements in the SQL query construction within the plugin's backend calendar class (includes/calendars/class-backend-calendar.php lines 155 and 164, and dopbs.php line 2300). The attack is blind - meaning query results are not returned directly - requiring time-based or boolean-based techniques to enumerate data. The affected product is identified by CPE cpe:2.3:a:dotonpaper:pinpoint_booking_system_-_version_2:*:*:*:*:*:*:*:* (vendor: dotonpaper), a WordPress booking management plugin. Because WordPress nonces bound to manage_options capability are surfaced on every admin page of the plugin, any attacker who achieves admin-level session access can trivially collect the nonce needed to reach the injectable endpoint.

RemediationAI

No patched release version is identified in the available data; version 2.9.9.6.9 is confirmed as the last vulnerable release. Administrators should immediately check the WordPress plugin repository for a version newer than 2.9.9.6.9 and apply it if available, referencing the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bb23bc2e-4484-46d5-b46e-5e43e5a1bf12 for patch confirmation. If no patched version is yet available, a compensating control is to restrict WordPress administrator account creation and enforce multi-factor authentication on all existing admin accounts, reducing the likelihood of credential compromise - note this does not eliminate the vulnerability but raises the cost of exploitation. Alternatively, if the plugin is not business-critical, temporary deactivation eliminates the attack surface entirely with no side effects beyond loss of booking functionality.