CVE-2026-12128 describes an improper input validation vulnerability (CWE-20) in the Pinpoint Booking System – Version 2 WordPress plugin. The vulnerability arises from the `dopbsp_woocommerce_add_to_cart` AJAX action being registered without authentication or nonce verification, allowing unauthenticated attackers to send malicious `cart_data` POST parameters. The plugin reads the `price_total` value directly from this attacker-controlled input and inserts it into the database without validating it against the calendar's configured pricing. Later, during the WooCommerce checkout process, the stored attacker-supplied price is used directly to set the product price without recalculation, enabling price manipulation and purchase of products at arbitrary prices.

An unauthenticated attacker can override the checkout price of any bookable product linked to the booking calendar to an arbitrary value. This compromises the integrity of pricing, potentially allowing attackers to purchase products at significantly reduced or zero cost. The vulnerability affects the integrity of the e-commerce transaction but does not impact confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected AJAX action or restricting access to it via custom authentication or nonce verification. Monitoring for unusual pricing activity may help detect exploitation attempts.