UNKNOWN NVD

CVE-2026-14853

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by om

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

References

https://wpscan.com/vulnerability/dd6ec707-3943-49be-81bb-c5dd51f2c001/

Published: 2026-08-23 · Source: NVD · Feed updated: 2026-08-23

This unknown severity vulnerability was published on 2026-08-23 via NVD.

vulnfeed aggregates 10950 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.