CVE-2026-39678
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Pinpoint Booking System plugin contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions from n/a through 2.9.9.7.2.
Risk Assessment
An attacker could gain access to functions or data they should not be authorized for, potentially leading to unauthorized actions. The risk affects organizations using affected versions of the plugin.
Recommendation
Update the Pinpoint Booking System plugin to a version later than 2.9.9.7.2. Verify access control configuration.
Other vulnerabilities in Pinpoint Booking System
See all- CVE-2026-12128Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.
- CVE-2026-15403Medium
The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.9 has a blind SQL Injection vulnerability via the 'field' parameter due to insufficient escaping and query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive data from the database.
Original NVD description (English source)
Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS