CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation
Unauthenticated attackers can manipulate booking prices to zero and obtain instantly-approved reservations by bypassing server-side validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15229?
CVE-2026-15229 is a medium-severity vulnerability in Unknown Pinpoint Booking System, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
Weakness: CWE-863
Which versions are affected by CVE-2026-15229?
How do I fix CVE-2026-15229?
No fix has been published for CVE-2026-15229 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-15229 being exploited?
There is no known exploitation of CVE-2026-15229 in the wild and no public exploit code.
Sources
Also known as GHSA-2jwj-8g7h-f5p5.