Security Alert Summary
The WooCommerce Bookings WordPress plugin before 3.9.0 contains an access control weakness in one of its AJAX actions. A missing capability check combined with a nonce validation that can be bypassed by omitting the token allows authenticated users with Subscriber-level access and above to create draft bookable products.
CVE Details
- CVE ID: CVE-2026-14853
- Affected component: WooCommerce Bookings WordPress plugin
- Affected versions: versions less than 3.9.0
- Published: August 23, 2026 at 06:17:16 AM UTC
- Last modified: August 23, 2026 at 04:16:36 PM UTC
- CVSS v3.1: Base Score 4.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / interaction: Requires an authenticated user account. Privileges required: LOW (Subscriber-level or above). User interaction: NONE.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None.
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability exists because one of the plugin’s AJAX actions does not perform a capability check and its nonce validation can be bypassed by omitting the token. In practice, this means an authenticated user with Subscriber-level access or higher can invoke that AJAX action and create draft bookable products despite not having the intended privileges.
The issue is rooted in missing authorization checks for the named AJAX action and an implementation of nonce handling that allows requests without a nonce token to proceed. The description does not name specific PHP functions or REST endpoints, so the explanation above is limited to the observable behavior: lack of capability verification on the AJAX handler and a bypassable nonce check.
Impact is limited to the ability to create draft bookable products (integrity impact). There is no indication in the provided data of disclosure of stored secrets, credential theft, or availability disruption.
How This Could Impact Your Website
Consider a small organization running WooCommerce Bookings with several user roles: a site owner, an internal content editor, and external contributors or contractors with Subscriber-level accounts. An authenticated subscriber or contractor could create draft bookable products using the vulnerable AJAX action. While drafts are not published automatically, they can clutter the product catalog, consume administrative time to review and remove, and reveal internal workflows around product setup.
Draft items created by low-privilege users could also be used to craft believable social engineering or targeted phishing attempts if attackers use the draft content or naming conventions to impersonate internal offers or staff. If your site uses automated notifications tied to product creation or workflow events, there is additional risk of misleading internal users or triggering notification noise.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts with write permissions.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and audit logs for unusual creation of draft products or unexpected AJAX requests.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
