CVE-2026-15229 describes an incorrect authorization vulnerability (CWE-863) in the Pinpoint Booking System WordPress plugin through version 2.9.9.6.9. The plugin fails to validate booking prices on the server side, enabling unauthenticated attackers to submit bookings with manipulated prices, including zero cost. Additionally, by selecting specific payment methods, attackers can bypass normal approval workflows and secure instant reservations without payment validation. This vulnerability impacts the integrity of the booking process and can lead to unauthorized free bookings.

The vulnerability allows unauthenticated attackers to create bookings at arbitrary prices, including free bookings, potentially resulting in financial loss and abuse of the booking system. There is no direct confidentiality or availability impact reported. The integrity of the booking process is compromised, allowing unauthorized reservations without proper payment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should monitor vendor communications for updates and consider implementing temporary controls such as restricting payment methods or adding server-side validation if feasible.