CVE-2026-14853: CWE-862 Missing Authorization in WooCommerce Bookings
Description
CVE-2026-14853 is a vulnerability in the WooCommerce Bookings WordPress plugin versions before 3.9.0. It involves missing authorization checks on an AJAX action, allowing users with Subscriber-level access and above to create draft bookable products. The nonce check intended to protect this action can be bypassed by omitting the token.
CVSS v3.1
Score 4.3medium
Affected software
WooCommerce Bookings
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WooCommerce Bookings plugin prior to version 3.9.0 does not perform proper capability checks on one of its AJAX actions. Additionally, the nonce verification can be bypassed by omitting the token parameter. This combination allows users with low-level privileges (Subscriber and above) to create draft bookable products without proper authorization.
Potential Impact
This vulnerability allows unauthorized users with Subscriber-level access or higher to create draft bookable products in the WooCommerce Bookings plugin. While it does not disclose sensitive information or allow direct code execution, it can lead to unauthorized content creation, potentially impacting the integrity of the booking system.
Mitigation Recommendations
A fix is available in WooCommerce Bookings version 3.9.0 and later. Users should upgrade to version 3.9.0 or above to remediate this vulnerability. No additional mitigation steps are required if the plugin is updated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-06T11:54:58.068Z
- State
- PUBLISHED
Threat ID: 6a8a91afacd9273b49900c79
Added to database: 08/23/2026, 06:22:39 UTC
Last enriched: 09/10/2026, 23:33:45 UTC
Last updated: 10/05/2026, 06:48:14 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.