CVE-2026-12128

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9

Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to cart AJAX action is registered without authentication or nonce verification. The update handler reads the price total value directly from the attacker-controlled cart data POST parameter and saves it to the database using $wpdb->insert() without validating it against the configured calendar pricing. Subsequently, the woocommerce before calculate totals callback retrieves this value and applies it to $product->set price() without recomputing the cost, allowing the price to be set to an arbitrary value.

Recommendations Update Pinpoint Booking System – Version 2 to a version newer than 2.9.9.6.8. As a temporary mitigation, restrict access to the dopbsp woocommerce add to cart AJAX action or avoid using the cart data parameter until the update is applied.