# CVE-2026-14854: WooCommerce Bookings unauthenticated denial of service via unbounded memory allocation

Source: https://junglewise.ai/threats/cve-2026-14854-the-woocommerce-bookings-wordpress-plugin-before-3-11-0-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-14854 · Severity: high · CVSS 7.5 · Published 2026-10-11

WooCommerce Bookings is a WordPress plugin that enables customers to book appointments and services. An unauthenticated attacker can exhaust the server's memory and crash the website with a single request by manipulating a user-controlled value in an AJAX action, causing denial of service to legitimate users.

Vendors: [WooCommerce](https://junglewise.ai/threats/vendors/woocommerce).

## Quick answers

**Is CVE-2026-14854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14854 being exploited in the wild.

**How severe is CVE-2026-14854?** High severity, with a CVSS score of 7.5, published 11 October 2026.

**Which products and versions are affected?** WooCommerce Bookings before 3.11.0.

**Is there a fix for CVE-2026-14854?** Yes: fixed in 3.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14854 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14854?** Check whether you run WooCommerce Bookings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.11.0

## Technical details

The plugin fails to validate or limit a user-supplied parameter before using it to allocate memory in an unauthenticated AJAX handler, enabling unbounded memory allocation. An attacker can trigger this remotely without authentication through a crafted request. The vulnerability allows a single request to exhaust available memory and crash the web application.

## Affected products

- WooCommerce Bookings before 3.11.0

## Timeline

- 2026-10-09: disclosed
- 2026-10-11: advisory

## References

- [https://wpscan.com/vulnerability/7b6aeaed-7600-4cf9-ba43-8a6fefb1a244/](https://wpscan.com/vulnerability/7b6aeaed-7600-4cf9-ba43-8a6fefb1a244/)