CVE-2026-14854

HighCVSS 7.5

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

The WooCommerce Bookings WordPress plugin before version 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

Risk Assessment

The attack can lead to service unavailability, impacting business continuity and potentially incurring downtime costs.

Recommendation

Update the WooCommerce Bookings plugin to version 3.11.0 or later, which includes the security fix.

Other vulnerabilities in WooCommerce Bookings

CVE-2026-14853Medium
The WooCommerce Bookings WordPress plugin before version 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

Original NVD description (English source)

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS