CVE-2026-14853 Overview
CVE-2026-14853 is a missing authorization vulnerability in the WooCommerce Bookings WordPress plugin in versions before 3.9.0. The plugin fails to perform a capability check on one of its AJAX actions. Its nonce check can also be bypassed by omitting the token entirely. Authenticated users with Subscriber-level access or higher can create draft bookable products on the affected site. The weakness is classified under CWE-862: Missing Authorization.
Critical Impact
Any authenticated user with Subscriber privileges can create unauthorized draft bookable products, expanding the attack surface of the WooCommerce store and enabling low-privilege content pollution.
Affected Products
- WooCommerce Bookings WordPress plugin versions prior to 3.9.0
- WordPress sites exposing subscriber-level registration with WooCommerce Bookings enabled
- WooCommerce storefronts relying on WooCommerce Bookings for appointment or reservation workflows
Discovery Timeline
- 2026-08-23 - CVE-2026-14853 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-14853
Vulnerability Analysis
The vulnerability stems from an AJAX handler in WooCommerce Bookings that does not validate the requesting user's WordPress capability. WordPress plugins normally combine a current_user_can() capability check with a nonce verification through check_ajax_referer() to gate privileged actions. In this plugin, the capability check is absent from the affected AJAX endpoint. The nonce verification is present but only executes when a token value is supplied by the client. Omitting the nonce parameter from the request bypasses the check entirely, allowing the request to reach the product-creation logic.
The resulting action creates a bookable product in draft status. Draft products are not immediately visible in the storefront, but they consume database rows, appear in the administrator dashboard, and can be abused to stage further attacks such as stored payload delivery or administrator social engineering.
Root Cause
The root cause is broken access control on a state-changing AJAX action. Two layers of the plugin's authorization model fail together: the capability gate is missing, and the nonce gate is conditional on the presence of a client-supplied token. An attacker who is already authenticated as a Subscriber can therefore invoke an action that should be restricted to shop managers or administrators.
Attack Vector
Exploitation requires network access to the WordPress site and a valid Subscriber-level account. Sites that allow open user registration are especially exposed. The attacker sends a crafted admin-ajax.php POST request targeting the vulnerable action while deliberately omitting the nonce parameter. No user interaction from an administrator is required. Refer to the WPScan Vulnerability Report for technical details on the affected endpoint.
Detection Methods for CVE-2026-14853
Indicators of Compromise
- Unexpected bookable products in wp_posts with post_status = 'draft' and post_type = 'product' authored by low-privilege accounts.
- POST requests to /wp-admin/admin-ajax.php from Subscriber sessions that lack a _wpnonce or security parameter.
- Newly registered Subscriber accounts creating product content shortly after login.
Detection Strategies
- Audit WordPress database entries for draft products whose post_author maps to non-privileged roles.
- Inspect web server access logs for admin-ajax.php traffic invoking WooCommerce Bookings actions without nonce fields.
- Correlate WordPress activity logs with user role data to identify Subscribers performing product-authoring actions.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture product creation, deletion, and role changes.
- Forward WordPress and web server logs to a centralized SIEM or data lake for retention and correlation.
- Alert on any product creation event initiated by an account without edit_products capability.
How to Mitigate CVE-2026-14853
Immediate Actions Required
- Upgrade the WooCommerce Bookings plugin to version 3.9.0 or later on all WordPress sites.
- Review existing draft bookable products and delete any that were not authored by legitimate staff.
- Audit Subscriber-level accounts and remove suspicious or unrecognized registrations.
Patch Information
The vendor addressed the issue in WooCommerce Bookings version 3.9.0. The patch adds a capability check to the affected AJAX action and enforces mandatory nonce verification. Administrators should apply the update through the WordPress plugin manager or WP-CLI. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable open user registration under Settings → General until the plugin is patched.
- Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privilege sessions using a web application firewall rule.
- Temporarily deactivate the WooCommerce Bookings plugin on sites that cannot be updated immediately.
# Update WooCommerce Bookings to the fixed version using WP-CLI
wp plugin update woocommerce-bookings --version=3.9.0
wp plugin list --name=woocommerce-bookings --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
