CVE-2026-14853: 
WordPress vulnerability analysis and mitigation

CVE-2026-14853 is a Missing Authorization vulnerability (CWE-862) in the WooCommerce Bookings WordPress plugin affecting all versions before 3.9.0. The flaw allows authenticated users with Subscriber-level access or above to create draft bookable products by bypassing the plugin's nonce check and exploiting a missing capability check on an AJAX action. It was publicly disclosed on August 21, 2026, and assigned a CVSS score of 4.3 (Medium) (WPScan, Github Advisory).

The root cause is a missing capability check (CWE-862 / OWASP A5: Broken Access Control) on one of the plugin's WordPress AJAX action handlers. Normally, WordPress nonces provide a layer of request validation, but the affected endpoint does not enforce nonce presence — omitting the token entirely bypasses this check. As a result, any authenticated user (Subscriber role or higher) can send a crafted AJAX request to the vulnerable endpoint and create draft bookable products without the required permissions. The vulnerability was discovered and reported by researcher Mike Gozdiskowski; a proof-of-concept is scheduled for public release on September 4, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated subscriber-level user to create draft bookable products on a WooCommerce-powered site, bypassing intended access controls. This could lead to unauthorized manipulation of the store's product inventory, potential disruption of booking workflows, and abuse of the booking system. While the impact is limited to product creation in draft state and does not directly expose sensitive data or allow remote code execution, it represents a meaningful integrity risk for e-commerce sites relying on WooCommerce Bookings (WPScan, Github Advisory).

There is no evidence of active in-the-wild exploitation at this time, and no public proof-of-concept exploit is currently available. WPScan has indicated that a PoC will be published on September 4, 2026. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication (minimum Subscriber role), which limits the attack surface compared to unauthenticated vulnerabilities (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running WooCommerce Bookings versions prior to 3.9.0 using tools like WPScan or by inspecting plugin version metadata in publicly accessible readme files.
2. Obtain Subscriber-level access: Register for an account on the target WordPress site (if open registration is enabled) or use existing low-privilege credentials.
3. Identify the vulnerable AJAX action: Analyze the plugin's JavaScript or source code to identify the specific wp_ajax_ or wp_ajax_nopriv_ action handler that lacks a capability check.
4. Craft the malicious AJAX request: Send an authenticated HTTP POST request to /wp-admin/admin-ajax.php targeting the vulnerable action, deliberately omitting the nonce (_wpnonce) parameter to bypass the nonce validation.
5. Create draft bookable product: Include the necessary POST parameters to define a draft bookable product. The server processes the request without verifying the user's capability, resulting in unauthorized product creation (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php from Subscriber-level accounts with the vulnerable action parameter, notably absent of a nonce field.
• Database: Unexpected draft WooCommerce bookable products (post_type = 'product' with post_status = 'draft') created by low-privilege user accounts (Subscriber role) in the wp_posts table.
• Logs: WordPress debug logs or server logs showing AJAX action invocations without corresponding nonce validation entries.
• User Activity: Audit logs (if enabled via plugins such as WP Activity Log) showing product creation events attributed to Subscriber-level users (WPScan).

Update the WooCommerce Bookings plugin to version 3.9.0 or later, which introduces proper capability checks on the affected AJAX action. As interim mitigations, site administrators should restrict open user registration if not required, audit existing Subscriber-level accounts, and consider implementing additional server-side validation for AJAX actions. Web application firewall (WAF) rules that block requests to admin-ajax.php missing nonce parameters for sensitive actions may also reduce exposure (WPScan, Github Advisory).