CVE-2026-12128 | CVSS: 5.3 | 严重级别: MEDIUM
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. Th
参考链接:
• https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/
• https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/
• https://plugins.trac.wordpress.org/browser/booking-system/tags/2.9.9.6.7/addons/
📌 数据来源: NVD 官方