The vulnerability arises from missing HttpOnly and Secure attributes on the pinpointJwt session cookie. This defect, classified as CWE-614, allows the cookie to be read via client‑side JavaScript through document.cookie and transmitted in clear text over HTTP. When combined with existing stored or reflected cross‑site scripting attacks—CWE-1004—an attacker can exfiltrate or hijack valid session tokens, enabling unauthorized access to the Pinpoint Booking System.

Pinpoint APM, delivered through the Pinpoint Booking System WordPress plugin, is affected. Versions up to 3.1.0 contain the flaw. The system operates within WordPress environments and is identified by the relevant CPE string, meaning any deployment using the pinpoint-apm:pinpoint plugin is vulnerable unless mitigated.

With a CVSS base score of 7.6, the flaw is rated high. Although EPSS data is not available, the combination of missing cookie flags and common XSS vectors creates a realistic exploitation scenario. The vulnerability is not listed in CISA's KEV catalog. The likely attack path is the exploitation of a stored or reflected XSS vulnerability to read the pinpointJwt cookie, or the passive sniffing of clear‑text traffic over non‑HTTPS connections to capture the session identifier, ultimately allowing session hijacking and compromise of the application.