WordPress Easy Booking plugin < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass vulnerability

Unauthenticated Minimum Booking Duration Bypass vulnerability discovered by marim00 in WordPress Plugin Easy Booking – WooCommerce Booking & Reservation Plugin versions 3.5.0...

CVE-2026-14831

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

CVE-2026-14831

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-14831 Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

CVE-2026-14831: Client-Side Enforcement of Server-Side Security

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders...

WordPress Easy Booking Plugin <= 1.0.3 - XSS

Because of this vulnerability in admin/editFacility.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...