Pinpoint through version 3.1.0 contains a server‑side request forgery vulnerability in the webhook registration endpoint. Because the application does not validate the destinations of webhook URLs, an authenticated user can register an internal URI. When the alarm threshold is breached, the Pinpoint server automatically issues a POST request to that URI, allowing the attacker to read or modify internal resources, including sensitive metadata endpoints. This flaw can lead to unauthorized disclosure of internal information and potentially aid further attacks against the network.

The defect affects the Pinpoint APM product, including the Pinpoint Booking System WordPress plugin. All deployments running Pinpoint up to and including version 3.1.0 are vulnerable. Specific affected versions are not listed in the advisory, so any installation of Pinpoint prior to a fix should be considered at risk.

The CVSS score of 6.3 indicates a moderate impact with the attack requiring authenticated access. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the flaw permits an attacker who can register webhooks to force the Pinpoint server to contact internal hosts, potentially leaking data or enabling lateral movement. Successful exploitation would be limited to those internal services accessible from the Pinpoint server, and it does not directly allow arbitrary code execution.