Description

The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and including, 2.9.9.6.8. This is due to the `dopbsp_woocommerce_add_to_cart` AJAX action being registered via `wp_ajax_nopriv_*` with no authentication, no nonce verification, and no server-side recalculation of pricing — the `update` handler reads `price_total` directly from the attacker-controlled `cart_data` POST parameter and persists it to the database via `$wpdb->insert()` without validating it against the calendar's configured pricing. The `woocommerce_before_calculate_totals` callback subsequently reads the stored attacker-supplied value back from the database and passes it directly to `$product->set_price()` without recomputing from calendar settings. This makes it possible for unauthenticated attackers to override the WooCommerce checkout price of any bookable product tied to a booking calendar to an arbitrary value, effectively enabling the purchase of any such product at a self-chosen price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-15T03:16:46.970Z",
  "pubdate": "2026-08-15T03:16:46.970Z",
  "executiveSummary": "The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to a Price Manipulation security flaw affecting all versions up to, and including, 2.9.9.6.8.\nThe vulnerability stems from improper input validation and the complete absence of server-side price recalculation within the WooCommerce integration component.\nUnauthenticated remote attackers can exploit this vulnerability via the dopbsp_woocommerce_add_to_cart AJAX action by leveraging the attacker-controlled cart_data parameter.\nBecause the application directly persists the user-supplied price_total value to the database via $wpdb->insert() and subsequently loads it during the woocommerce_before_calculate_totals hook without verification, unauthorized actors can successfully override the checkout price of any bookable product.\nThe potential impact allows malicious entities to purchase high-value bookable services and products at arbitrarily chosen or nominal costs, resulting in severe financial loss and business logic compromise.\nNo authentication, capability checks, or cryptographic nonce verifications are required to execute this attack.",
  "technicalDetails": "The vulnerability resides within the WooCommerce integration mechanisms of the Pinpoint Booking System – Version 2 plugin, specifically impacting versions up to, and including, 2.9.9.6.8.\nThe primary root cause is insecure implementation of the AJAX request handler associated with the dopbsp_woocommerce_add_to_cart action. This action is improperly registered using the wp_ajax_nopriv_* hook, exposing functionality intended for order processing to unauthenticated network traffic.\nFurthermore, the handler completely lacks nonce verification (CSRF protection) and user authentication checks, allowing any external entity to interact with the backend endpoint directly.\nDuring execution, the update handler processes the POST parameter cart_data. Specifically, it extracts the price_total attribute directly from this unvalidated, user-supplied data structure.\nInstead of querying the backend calendar settings, retrieving authoritative rate schedules, and server-side recalculating the correct pricing, the component directly persists the attacker-controlled price value to the database utilizing the WordPress database abstraction layer via $wpdb->insert().\nSubsequently, when items proceed toward checkout, the woocommerce_before_calculate_totals callback hook reads the malicious, stored price value directly from the database and injects it into WooCommerce by passing it straight to the $product->set_price() method without any intermediate validation or sanitization.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts an arbitrary cart data payload containing a modified price_total parameter. Second, the attacker issues an HTTP POST request targeting the exposed AJAX endpoint invoking dopbsp_woocommerce_add_to_cart. Third, the vulnerable plugin accepts the input without validation, storing the manipulated pricing metric inside the database. Fourth, during the WooCommerce cart calculation phase, the stored fraudulent price is retrieved and assigned to the product object. Finally, the victim or attacker completes the WooCommerce checkout process, successfully acquiring the bookable item at the manipulated price point."
}