{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15229", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-07-09T11:07:35.406Z", "datePublished": "2026-08-10T06:00:17.447Z", "dateUpdated": "2026-08-10T06:00:17.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-10T06:00:17.447Z"}, "title": "Pinpoint Booking System <= 2.9.9.6.9 - Unauthenticated Arbitrary Booking Price Manipulation", "problemTypes": [{"descriptions": [{"description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Pinpoint Booking System", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "2.9.9.6.9"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation."}], "references": [{"url": "https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Ahmed Hashim Ismael", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Pinpoint Booking System", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "2.9.9.6.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation."}], "id": "CVE-2026-15229", "lastModified": "2026-08-10T07:16:47.607", "metrics": {}, "published": "2026-08-10T07:16:47.607", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/be12c266-dee7-463d-ae71-9f7b7e0258ee/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}