CVE-2026-39678
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing authorization in the Pinpoint Booking System plugin (booking-system) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 2.9.9.6.5 inclusive.
Risk Assessment
Unauthorized users may gain access to functions or data that should be protected, potentially leading to confidentiality or integrity breaches.
Recommendation
It is recommended to update the Pinpoint Booking System plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.6.5.