Dotonpaper
Monthly
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can bypass access control in DOTonPAPER Pinpoint Booking System versions up to 2.9.9.6.5 to view sensitive booking data due to missing authorization checks on API endpoints. The vulnerability allows information disclosure with low confidentiality impact, and while CVSS rates it 5.3 (medium), the 0.02% EPSS score indicates minimal real-world exploitation probability despite the straightforward network-based attack vector.
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Price manipulation in the Pinpoint Booking System - Version 2 WordPress plugin (all versions ≤2.9.9.6.8) enables unauthenticated remote attackers to purchase any WooCommerce bookable product at a self-chosen price by injecting an arbitrary `price_total` value into the `cart_data` POST parameter. The vulnerable `dopbsp_woocommerce_add_to_cart` AJAX handler - registered via `wp_ajax_nopriv_*` with no authentication and no nonce check - persists the attacker-supplied price directly to the database and a subsequent WooCommerce hook reads it back to set the product price without recalculation. No public exploit has been identified at time of analysis, though the code paths are fully visible in the public WordPress plugin repository, materially lowering the barrier to exploitation.
Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can bypass access control in DOTonPAPER Pinpoint Booking System versions up to 2.9.9.6.5 to view sensitive booking data due to missing authorization checks on API endpoints. The vulnerability allows information disclosure with low confidentiality impact, and while CVSS rates it 5.3 (medium), the 0.02% EPSS score indicates minimal real-world exploitation probability despite the straightforward network-based attack vector.
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.