CVE-2026-14854: WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.

Q: What is the impact of successful exploitation?

A single request can exhaust server memory and make the affected site unavailable. The provided CVSS vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Which versions need to be remediated?

WooCommerce Bookings versions before 3.11.0 are affected. Upgrade to version 3.11.0 or later.

Published Oct 11, 2026

Updated

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.

Affected Software

1 affected component

WooCommerce WooCommerce Bookings<3.11.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it. No account, privileges, or user interaction are required.

What is the impact of successful exploitation?

A single request can exhaust server memory and make the affected site unavailable. The provided CVSS vector indicates availability impact only, with no stated confidentiality or integrity impact.

Which versions need to be remediated?

WooCommerce Bookings versions before 3.11.0 are affected. Upgrade to version 3.11.0 or later.

CVE-2026-14854: WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions need to be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which versions need to be remediated?