CVE-2026-14831 Easy Booking CVE debrief

Who should care

Users of the Easy Booking WordPress plugin, particularly those with public-facing booking functionality, should be aware of this vulnerability and take steps to mitigate it. This includes verifying the plugin version, reviewing server-side configurations, and monitoring for suspicious activity. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize remediation efforts.

Technical summary

The Easy Booking WordPress plugin before 3.5.0 does not enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders. This vulnerability has a medium severity and requires attention from users of the plugin, particularly those with public-facing booking functionality.

Defensive priority

Medium-priority vulnerability in the Easy Booking WordPress plugin, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.

Recommended defensive actions

• Verify the Easy Booking WordPress plugin version and ensure it is updated to 3.5.0 or later.
• Review server-side configurations to enforce minimum booking durations for bookable products.
• Monitor for suspicious activity related to underpriced orders and below-minimum bookings.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from the NVD and WPScan suggests a medium-severity vulnerability in the Easy Booking WordPress plugin. Limited information is available on the vendor's remediation efforts. The vulnerability allows unauthenticated users to place below-minimum bookings and complete underpriced orders. Defenders should verify the plugin version, review server-side configurations, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.