CVE-2026-12128 describes an improper input validation vulnerability (CWE-20) in the Pinpoint Booking System – Version 2 WordPress plugin. The vulnerability arises from the dopbsp_woocommerce_add_to_cart AJAX action being registered without authentication or nonce verification, allowing unauthenticated users to submit manipulated cart_data POST parameters. Specifically, the price_total value is taken directly from attacker-controlled input and inserted into the database without validation against calendar pricing settings. Later, this manipulated price is read back and applied to WooCommerce products without recalculation, enabling attackers to override checkout prices arbitrarily.

An unauthenticated attacker can manipulate the price of any bookable product linked to a booking calendar, effectively purchasing products at attacker-chosen prices. This leads to integrity loss in pricing and potential financial loss for merchants using the affected plugin. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX action or implement server-side validation and price recalculation to prevent unauthorized price manipulation. Monitor vendor channels for official patches or updates addressing this issue.