The WooCommerce Bookings plugin versions prior to 3.9.0 contain a missing authorization vulnerability (CWE-862) where an AJAX action does not verify user capabilities. Additionally, the nonce protection can be bypassed by omitting the token, enabling users with minimal privileges (Subscriber-level and above) to create draft bookable products. This flaw could lead to unauthorized content creation within the plugin's booking system.

Users with Subscriber-level access or higher can create draft bookable products without proper authorization, potentially leading to unauthorized content insertion or manipulation within the WooCommerce Bookings system. There is no indication of further privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for unauthorized draft bookable products. Avoid granting Subscriber-level access to untrusted users.