CVE-2026-14853 in Bookings Plugin
Summary
by MITRE • 08/23/2026
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in WooCommerce Bookings versions prior to 3.9.0 represents a critical authentication and authorization flaw within the plugin's AJAX handling mechanisms. This issue stems from an insufficient verification of user permissions when processing specific administrative actions via asynchronous JavaScript requests. Specifically, the affected code path fails to enforce proper capability checks that are standard for operations modifying product data in WordPress environments. While the implementation includes a nonce check designed to prevent Cross-Site Request Forgery attacks, this security control is fundamentally compromised because it can be bypassed by simply omitting the required token from the request payload. This oversight allows attackers with low-privilege accounts, such as those assigned the Subscriber role or higher, to execute administrative functions that should strictly require elevated privileges like Administrator access.
From a technical perspective, this flaw aligns closely with CWE-285 Improper Authorization and CWE-352 Cross-Site Request Forgery (CSRF). The absence of a robust capability check means that the application does not verify whether the authenticated user has the specific rights required to perform the action, relying instead on flawed or bypassable nonce validation. In WordPress architecture, AJAX endpoints often serve as entry points for state-changing operations, and failing to validate permissions at this layer creates a direct path for privilege escalation. By omitting the nonce token, an attacker can trick the server into processing the request without validating its authenticity against the current session, effectively neutralizing one of the primary defenses against CSRF attacks while simultaneously exploiting the lack of authorization checks.
The operational impact of this vulnerability is significant due to the nature of the affected functionality: the creation of draft bookable products. An attacker with Subscriber-level access or above can exploit this flaw to inject malicious content into the site's product catalog without detection by standard administrative oversight mechanisms. This capability enables several potential downstream attacks, including the injection of phishing links within booking forms, the disruption of business operations through spam bookings, or the establishment of a persistent foothold for further exploitation if combined with other vulnerabilities in the plugin ecosystem. The ability to create drafts is particularly dangerous because it allows attackers to stage malicious content that may go unnoticed until manually reviewed by an administrator, thereby increasing the window of exposure and potential damage.
This vulnerability maps directly to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires valid user credentials at a minimum level of Subscriber access, which is often granted to casual users or customers on e-commerce sites. It also relates to T1496 Endpoint Denial of Service if the attacker uses this capability to flood the system with fake bookings, and potentially T1505 Software Field Components if the created products are used to execute further malicious scripts via embedded content. The lack of proper authorization checks highlights a common misconfiguration in plugin development where convenience or incomplete testing leads to relaxed security controls on AJAX endpoints that handle sensitive data modifications.
To mitigate this vulnerability, organizations must immediately update the WooCommerce Bookings plugin to version 3.9.0 or later, which addresses these authentication and authorization flaws by implementing rigorous capability checks for all relevant AJAX actions. Until an upgrade is feasible, administrators should consider restricting user roles on WordPress sites that utilize this plugin, ensuring that only trusted individuals with Administrator-level access can interact with booking-related features if possible. Additionally, deploying a Web Application Firewall (WAF) configured to detect and block anomalous AJAX requests lacking valid nonces or attempting unauthorized state changes can provide an additional layer of defense. Regular security audits and code reviews focusing on privilege escalation vectors in third-party plugins are essential practices to prevent similar issues from arising in the future.