CVE-2026-15403 is a blind SQL Injection vulnerability in the Pinpoint Booking System – Version 2 WordPress plugin affecting all versions up to and including 2.9.9.6.9. The issue arises from improper neutralization of special elements in the 'field' parameter, allowing authenticated administrators to append SQL queries to existing ones. The nonce required for exploitation is exposed on all plugin admin pages under manage_options, making exploitation straightforward for privileged users. This vulnerability can be used to extract sensitive database information without impacting availability or integrity.

An authenticated attacker with administrator-level privileges can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not affect availability or integrity but compromises confidentiality of data stored in the database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for unusual database queries. Avoid exposing the vulnerable plugin in environments where untrusted administrators have access.