EUVD-2026-96746
GHSA-j5fj-p46h-2j27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach unauthenticated AJAX endpoint
-
ExploitSubmit oversized allocation value
-
ExecutionExhaust server memory
-
ImpactDenial of Service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond the plugin being installed and active - exploitation targets an unauthenticated AJAX action in WooCommerce Bookings versions before 3.11.0 that accepts a user-supplied value used to size a memory allocation without limiting it. No authentication, user interaction, or non-default configuration is required (PR:N/UI:N), and a single request triggers the condition. The practical limiting factor is scope: the affected product is the paid WooCommerce Bookings extension specifically (not core WooCommerce), so only sites running that plugin at a version below 3.11.0 are exposed, and impact is restricted to availability (service outage) with no data or integrity consequences. |
| Impact | All exploitability signals align toward genuine, easy abuse: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated, no-interaction attack, and the description confirms a single request is sufficient. Publicly available exploit code (WPScan) further lowers the barrier. However, impact is confined to availability only (C:N/I:N/A:H) - this is a CWE-400 uncontrolled resource consumption DoS with no code execution, data disclosure, or integrity loss, which is why the score caps at 7.5/High rather than Critical. The flaw is not listed in CISA KEV and no EPSS probability was supplied in the input, so there is no evidence of active or mass exploitation at this time; the real-world priority is moderate-to-high for any internet-facing WooCommerce Bookings site because the attack is trivial and pre-auth, but the blast radius is limited to a single site's uptime rather than a systemic compromise. No conflicting signals were detected between the CVSS vector and the description - both consistently indicate remote unauthenticated network access. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted request to the plugin's vulnerable AJAX endpoint, supplying an attacker-controlled numeric value that the plugin uses to allocate memory without bounds checking. The server attempts the oversized allocation, exhausts available PHP/server memory, and the site becomes unavailable to legitimate customers. Public exploit code from WPScan exists, making this immediately reproducible with no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
RemediationAI
Upgrade WooCommerce Bookings to 3.11.0 or later, which is the vendor-released patch line that removes the unbounded allocation in the affected AJAX action; verify the installed version under Plugins in wp-admin or via WP-CLI, since the extension is a paid product updated through the WooCommerce account rather than the public plugin directory, and confirm the update actually applied on any site using a staging-before-production workflow. If the update cannot be deployed immediately, the most direct compensating control is to block requests to /wp-admin/admin-ajax.php that carry the affected action parameter (the exact action name is documented in the WPScan advisory at https://wpscan.com/vulnerability/7b6aeaed-7600-4cf9-ba43-8a6fefb1a244/) using a WAF or reverse-proxy rule - the trade-off is that legitimate storefront booking flows also use admin-ajax.php, so the rule must match the specific action rather than the endpoint, or booking widgets will break for customers. Temporarily deactivating the WooCommerce Bookings plugin removes the exposure entirely but disables all booking functionality, which is only acceptable for sites that do not currently take bookings. Lowering PHP memory_limit or per-request memory ceilings can reduce the blast radius of a single oversized allocation and is low-risk to apply alongside the patch, but it does not eliminate the DoS if an attacker sends concurrent requests, and setting it too low may cause legitimate booking operations to fail. Fronting the site with a rate limiter or connection cap on admin-ajax.php reduces the impact of request floods but adds latency for all AJAX-driven functionality, and none of these workarounds substitute for applying 3.11.0. Additional tracking and advisory context is available under EUVD-2026-96746 and at https://nvd.nist.gov/vuln/detail/CVE-2026-14854.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WooCommerce Bookings is a paid WordPress extension (plugin slug woocommerce-bookings) that adds booking and availability logic on top of WooCommerce. The flaw sits in an AJAX handler the plugin registers for unauthenticated callers through the standard WordPress AJAX dispatch path (/wp-admin/admin-ajax.php, reached via wp_ajax_nopriv_* hooks), meaning no login is needed to reach the vulnerable code. The root-cause class is CWE-400, Uncontrolled Resource Consumption: a request-supplied value is used as the size argument for a memory allocation without any upper bound or sanity check, so the attacker effectively chooses how much memory the PHP worker must reserve. Because PHP memory is governed by memory_limit and the process pool is finite, an oversized allocation reliably produces a fatal out-of-memory error in the handling worker, and repeated or concurrent requests accelerate worker starvation and full service unavailability. The supplied CPE string (cpe:2.3:a:unknown:woocommerce_bookings:*:*:*:*:*:*:*:*) carries an unconfirmed vendor token, reflecting WPScan-style plugin-slug tracking rather than a defect in attribution - the affected component is unambiguously the WooCommerce Bookings plugin, tracked with the EUVD identifier EUVD-2026-96746 and matching the EUVD version range 0 through <3.11.0.
Know when Woocommerce Bookings gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated AJAX action triggered by one request (AV:N/AC:L/PR:N/UI:N); memory exhaustion yields availability-only impact (A:H, C:N/I:N) with no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.
Technical POC Analysis
Class: CWE-400, Uncontrolled Resource Consumption.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A memory-exhaustion flaw in the paid WooCommerce Bookings extension (versions before 3.11.0) allows an unauthenticated attacker to take a WordPress storefront offline with a single crafted request, and publicly available exploit code exists. Only sites running this extension below 3.11.0 are exposed - core WooCommerce is unaffected - and the impact is limited to downtime, with no confidentiality or integrity loss to customer or payment data. Because no credentials or user interaction are required, any internet-facing booking-enabled storefront meeting the version condition is trivially reachable, making lost booking revenue and customer-facing availability the primary leadership concerns.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Woocommerce Bookings
View allAuthorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.15.78. Rated medium s
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.0.3. Rated medium severity (CVSS 4.3
Exploit-DB