Vulnerability · Published Aug 23, 2026 · Assigned by WPScan
CVE-2026-14853WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
Medium 4.3
In plain English
A medium-severity missing authorization in WooCommerce Bookings from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WooCommerce Bookings | 0 – before 3.9.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/dd6ec707-3943-49be-81bb-c5dd51f2c001/ exploit, vdb-entry, technical-description