CVE-2026-14853 - WooCommerce Bookings 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization
Brief
CVE ID : CVE-2026-14853
Published : Aug. 23, 2026, 6:17 a. m.
- 14 hours, 54 minutes ago
Description : The WooCommerce Bookings WordPress plugin before 3.
- 0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.
Severity: 4.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...