CVE-2026-12128: Pinpoint Booking System – Version 2 plugin for WordPre
CVE-2026-12128 analysis covering impact, affected products, versions, remediation, and cross-checked defender guidance.
CVE-2026-12128 is a vulnerability published by NVD on 8/15/2026.
What happened
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
Affected products and versions
- NVD has not published a normalized affected-product configuration yet.
Severity and weakness
CVSS: MEDIUM 5.3. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Weaknesses: CWE-20.
Known exploitation
No CISA KEV entry is currently attached to the NVD record.
What defenders should do
- Identify whether the affected product and version range exists in production.
- Review vendor advisories and release notes before change windows.
- Patch, upgrade, disable the vulnerable component, or apply vendor mitigations.
- Verify the running version after deployment, not only the package inventory.
Official and supporting references
- No vendor advisory tagged by NVD at draft time.