CVE-2026-14831 is a vulnerability in the Easy Booking WordPress plugin prior to version 3.5.0. The plugin fails to re-validate the minimum booking duration on the server side when adding a booking to the cart and calculating its price. This allows unauthenticated attackers to bypass the minimum booking duration restriction and complete orders at a lower price than configured. The weakness is classified under CWE-602, indicating client-side enforcement of server-side security controls. The CVSS 3.1 base score is 5.3 (medium severity), reflecting that the vulnerability is remotely exploitable without privileges or user interaction and impacts integrity by allowing underpriced bookings.

Unauthenticated users can place bookings with durations shorter than the configured minimum, resulting in underpriced orders. This impacts the integrity of the booking system by allowing manipulation of booking prices and durations, potentially causing financial loss to the site owner. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to missing server-side validation, upgrading to Easy Booking version 3.5.0 or later (once confirmed) or applying any official fixes from the vendor is recommended. Until a patch is available, site administrators should consider disabling the plugin or implementing server-side validation controls to enforce minimum booking durations.