Atomic Edge analysis of CVE-2026-12128 (metadata-based):
This vulnerability affects the Pinpoint Booking System plugin for WordPress, all versions up to and including 2.9.9.6.8, and allows unauthenticated price manipulation of WooCommerce checkout totals. The CVSS score is 5.3 (Medium), reflecting a low integrity impact with no confidentiality or availability impact. The root cause lies in the `dopbsp_woocommerce_add_to_cart` AJAX action, which is registered via `wp_ajax_nopriv_*` and executable without authentication or nonce verification. The vulnerable code reads `price_total` from the attacker-controlled `cart_data` POST parameter and inserts it into the database via `$wpdb->insert()` without server-side recalculation or validation against the calendar’s configured price. Later, the `woocommerce_before_calculate_totals` callback retrieves this stored value and passes it directly to `$product->set_price()`, overriding the legitimate product price.
Root Cause: The core issue is improper input validation (CWE-20) combined with a failure to enforce server-side business logic. The plugin trusts client-supplied pricing data (`cart_data[price_total]`) without verifying it matches the calendar’s defined price or applying any authorization checks. This is confirmed by the vulnerability description’s explicit mention of the `wp_ajax_nopriv_` registration, absence of nonce and capability checks, and direct database persistence of the attacker-supplied value. Atomic Edge analysis infers that the `update` handler does not recalculate the price from the database, and the `woocommerce_before_calculate_totals` hook blindly trusts the stored value. These conclusions are based on the description’s detailed technical breakdown; however, without access to the plugin source code, we cannot confirm the exact file and function names.
Exploitation: An unauthenticated attacker can craft an HTTP POST request to `/wp-admin/admin-ajax.php` with the `action` parameter set to `dopbsp_woocommerce_add_to_cart`. The `cart_data` parameter must include an `id` (the booking product ID) and a `price_total` set to the desired amount (e.g., 0.01). Because the AJAX handler has no nonce or permission checks, the request succeeds without credentials. The plugin then stores the attacker-controlled price in the database, and when the cart recalculates totals, the product uses that stored price. The attacker can then complete the WooCommerce checkout at the manipulated price, potentially free or nearly free. Atomic Edge analysis notes that the exact parameter structure inside `cart_data` may vary slightly, but the core exploit pattern is sending the `price_total` field through the AJAX action.
Remediation: A proper fix requires the plugin to validate and recalculate price server-side from the calendar’s configured pricing whenever a booking is added to the cart. Specifically, the `dopbsp_woocommerce_add_to_cart` handler should verify a valid nonce, enforce the appropriate capability for unauthenticated users (or use a deterministic, server-side price), and reject any client-supplied `price_total` that does not match the calculated amount. The stored price should be derived from the booking parameters, not from user input. Until a patch is available, site administrators should disable or restrict the vulnerable AJAX action, possibly by adding a WAF rule to block requests containing a modified `price_total`. Atomic Edge analysis emphasizes that the plugin should never trust client-side price fields in any commerce transaction.
Impact: Successful exploitation allows any unauthenticated visitor to set the checkout price of any WooCommerce product tied to a Pinpoint Booking System calendar to an arbitrary value, including zero. This can lead to significant financial loss for store owners, as attackers can make purchases for free or at drastically reduced prices. The vulnerability does not directly expose data or escalate privileges, but the ability to manipulate order totals undermines the integrity of the e-commerce system. The impact is limited to integrity (price manipulation) and does not affect confidentiality or availability, aligning with the CVSS vector. Given the pre-auth nature and lack of complexity, this vulnerability is a high-priority target for automated attacks, though it carries a Medium severity score due to its narrow scope.
