CVE-2026-12128 Business logic in Pinpoint Booking System – Version 2
Unauthenticated attackers can manipulate booking prices by injecting arbitrary values into the cart data parameter, bypassing server-side price validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12128?
CVE-2026-12128 is a medium-severity vulnerability in dotonpaper Pinpoint Booking System – Version 2, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.
Weakness: CWE-20
Which versions are affected by CVE-2026-12128?
How do I fix CVE-2026-12128?
No fix has been published for CVE-2026-12128 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12128 being exploited?
There is no known exploitation of CVE-2026-12128 in the wild and no public exploit code.
Sources
Also known as GHSA-w46h-pcxr-j4fq.