Woocommerce Bookings
Monthly
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.15.78. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.0.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory exhaustion denial of service in WooCommerce Bookings (versions before 3.11.0) allows unauthenticated remote attackers to take a WordPress site offline with a single crafted request, because one of the plugin's unauthenticated AJAX actions feeds a user-supplied value directly into a memory allocation routine without validating or capping its size (CWE-400). Exposure is limited in scope but not in ease: only sites running the paid WooCommerce Bookings extension below 3.11.0 are affected (core WooCommerce is not), while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H, score 7.5) confirms that no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists, so any internet-facing site meeting the version condition should be treated as trivially reachable; the consequence is availability loss only, with no confidentiality or integrity impact.
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.15.78. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.0.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.