CVE-2026-14853: Unknown Woocommerce Bookings

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

Affected products

• Unknown Woocommerce Bookings: before 3.9.0 (fixed in 3.9.0)

Published 2026-08-23. Last modified 2026-08-26.