The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate booking price on the server side, allowing unauthenticated users to create bookings at any price, including zero. By selecting a particular payment method, the attacker can obtain an instantly‑approved reservation. This flaw enables financial exploitation and undermines the integrity of booking records.

Any WordPress site that has the Pinpoint Booking System plugin installed with a version of 2.9.9.6.9 or earlier.

Because the flaw can be triggered without authentication, the attack vector is likely a web request to the booking endpoint. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of server‑side validation and the ability to generate legitimate, yet inflated, reservations pose a significant risk of financial fraud and service abuse. Attackers can repeatedly exploit the plugin to create low‑price or free bookings and gain unauthorized access to the booking system.