Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-14853 The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting… https://www.cve.org/CVERecord?id=CVE-2026-14853
Post summary
The entry discloses a capability-check bypass vulnerability in the WooCommerce Bookings WordPress plugin prior to version 3.9.0, with no mention of exploits, patches, or active exploitation.
CVE-2026-14853 WooCommerce Bookings Allows Subscribers To Create Draft Products https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14853
Post summary
The post announces CVE-2026-14853 for WooCommerce Bookings, noting it allows subscribers to create draft products, but provides no further details.