CVE-2026-14831: Unknown Easy Booking

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.

Affected products

• Unknown Easy Booking: before 3.5.0 (fixed in 3.5.0)

Published 2026-08-06. Last modified 2026-08-26.