CVE-2023-45270 MEDIUM

CVE-2023-45270: WordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Pinpoint.world
Product Pinpoint Booking System
Weakness CWE-352 · CSRF
Published October 13, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Pinpoint Booking System contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unwanted actions on behalf of a logged-in user. An attacker can craft a malicious link or page that, when visited by a user, triggers unintended changes to bookings or system settings. The vulnerability affects versions up to 2.9.9.4.0. Update to a version newer than the affected range to remediate.

What an attacker can do

03Attacker Capabilities

Trick a logged-in user into performing unwanted booking or system changes via a malicious link or page.

Potential impact on your site

04Site Impact

Bookings or system settings can be modified without the user's knowledge if they visit a malicious site while logged in.

Conditions required to exploit

05Prerequisites

User must be logged in and click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

October 13, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57766 WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-13422 HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2016-20083 WordPress More Fields Plugin 2.1 Cross-Site Request Forgery