WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability

Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...

CVE-2026-14831

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

CVE-2026-14831 Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

CVE-2026-14831

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14831: Client-Side Enforcement of Server-Side Security

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

PT-2026-68647

Name of the Vulnerable Software and Affected Versions Easy Booking WordPress plugin versions prior to 3.5.0 Description The plugin fails to enforce the configured minimum booking duration on the server side during the process of adding a product to the cart and calculating the booking price. This...

WordPress Easy Booking Plugin <= 1.0.3 - XSS

Because of this vulnerability in admin/editFacility.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...