CVE-2026-15403 in Pinpoint Booking System Plugin
Summary
by MITRE • 08/01/2026
The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and including, 2.9.9.6.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable endpoint is emitted on all plugin admin pages loaded under manage_options, making it trivially obtainable by any authenticated administrator.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The Pinpoint Booking System plugin for WordPress represents a critical security vulnerability through a blind SQL injection flaw that affects versions up to and including 29969. This vulnerability stems from inadequate input sanitization within the 'field' parameter processing mechanism, creating an exploitable pathway for malicious actors who possess administrative privileges. The technical implementation fails to properly escape user-supplied parameters before incorporating them into database queries, while simultaneously lacking proper query preparation measures that would normally protect against such attacks. The flaw operates as a blind SQL injection because the attacker cannot directly observe query results through error messages or direct output, instead inferring information through indirect means such as response timing variations or conditional responses.
The operational impact of this vulnerability extends beyond simple data theft, as authenticated administrators with sufficient privileges can leverage this weakness to extract sensitive database information including user credentials, system configurations, and potentially other administrative data. The attack vector becomes particularly dangerous because the nonce token required to access the vulnerable endpoint is automatically rendered on all plugin administration pages that operate under the manage_options capability level, making it readily available to any authenticated administrator. This design flaw removes any barrier to exploitation for those who already possess administrative access, transforming what could be a complex multi-stage attack into a straightforward privilege escalation technique. The vulnerability directly maps to CWE-89 which describes improper neutralization of special elements used in an SQL command, and aligns with ATT&CK technique T1078 004 for valid accounts and T1566 001 for credential access through exploitation.
The security implications compound when considering that the vulnerable endpoint accepts user-supplied parameters without adequate sanitization or parameter binding, allowing attackers to manipulate existing SQL queries through injection techniques. This allows for the construction of additional SQL operations that can extract data from database tables, potentially including WordPress user tables containing hashed passwords, session information, and configuration settings. The blind nature of the injection requires sophisticated exploitation techniques where attackers must carefully craft their payloads and analyze response characteristics to infer database contents. The vulnerability's persistence across multiple versions indicates a fundamental flaw in the plugin's input handling architecture rather than a temporary coding oversight, making it particularly concerning for organizations with numerous installations. Organizations should implement immediate mitigations including plugin updates to patched versions, implementation of web application firewalls, and comprehensive monitoring for suspicious database activity patterns that may indicate exploitation attempts.