CVE-2026-14854

Summary

The WooCommerce Bookings plugin has a memory exhaustion vulnerability in its unauthenticated AJAX handler that allows attackers to allocate excessive memory with a single request, leading to denial of service. This affects WordPress sites using the plugin and can be exploited without authentication.

Exploitability

The exploit is very easy to execute with no prerequisites - an attacker only needs to send a single crafted request to the vulnerable AJAX endpoint to trigger memory exhaustion.

Blast radius

The impact could affect entire WordPress sites, potentially causing downtime for all users while the server struggles with memory allocation, especially on resource-constrained hosting environments.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.11.0 or later

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.