Improper Access Control in WooCommerce Bookings Plugin by Automattic
CVE-2026-14853
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14853?
The WooCommerce Bookings plugin for WordPress prior to version 3.9.0 contains an improper access control vulnerability. It lacks adequate checks on an AJAX action, enabling users with Subscriber-level roles or higher to create draft bookable products by bypassing the nonce verification process. This flaw could allow unauthorized users to exploit the functionality, potentially leading to the creation and management of bookable items without proper authorization.
Affected Version(s)
WooCommerce Bookings 0 < 3.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.