Is CVE-2026-14854 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-14854

Description

The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.