{"id":"CVE-2026-14854","aliases":["EUVD-2026-96746","GHSA-j5fj-p46h-2j27"],"status":"published","title":"WooCommerce Bookings \u003c 3.11.0 - Unauthenticated Denial of Service","description":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00338,"percentile":0.27509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-10-11T06:00:10Z","modified":"2026-10-13T20:36:00Z","products":[{"vendor":"unknown","product":"woocommerce bookings"},{"vendor":"woocommerce","product":"woocommerce bookings"}],"references":[{"url":"https://wpscan.com/vulnerability/7b6aeaed-7600-4cf9-ba43-8a6fefb1a244/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14854"},{"url":"https://wpscan.com/vulnerability/7b6aeaed-7600-4cf9-ba43-8a6fefb1a244"},{"url":"https://github.com/advisories/GHSA-j5fj-p46h-2j27"}],"sources":{"cve":[{"id":"CVE-2026-14854","title":"WooCommerce Bookings \u003c 3.11.0 - Unauthenticated Denial of Service","description":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","status":"published","published":"2026-10-11T06:00:10.284Z","modified":"2026-10-11T11:32:46.642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-96746","description":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","status":"published","published":"2026-10-11T06:00:10Z","modified":"2026-10-11T11:32:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:23.217739Z"}],"ghsa":[{"id":"GHSA-j5fj-p46h-2j27","title":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value...","description":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","status":"published","published":"2026-10-11T09:30:24Z","modified":"2026-10-11T12:31:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:13:04.632316Z"}],"nvd":[{"id":"CVE-2026-14854","description":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","status":"published","published":"2026-10-11T07:17:24.003Z","modified":"2026-10-13T20:36:00.85Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:55.874869Z"}]}}