CVE-2026-15403

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.10

Description Insufficient escaping of user-supplied parameters and lack of proper preparation in SQL queries allow authenticated attackers with administrator-level access and above to perform blind SQL Injection. By manipulating the field parameter, an attacker can append additional SQL queries to extract sensitive information from the database. The nonce required to access the vulnerable endpoint is available on all plugin admin pages loaded under manage options, allowing any authenticated administrator to obtain it easily.

Recommendations Update to a version newer than 2.9.9.6.9. Avoid using the field parameter in the affected plugin functionality until the update is applied.