CVE-2026-14854: Unauthenticated Memory-Exhaustion DoS in WooCommerce Bookings

Overview

A denial-of-service vulnerability, tracked as CVE-2026-14854, has been disclosed in WooCommerce Bookings, the appointment and rental-scheduling add-on for the widely deployed WooCommerce e-commerce plugin. Versions before 3.11.0 fail to bound a user-supplied value before using it to allocate memory inside one of the plugin's unauthenticated AJAX actions, letting an attacker exhaust server memory — and take the site down — with a single crafted request.

No authentication, prior session, or user interaction is required, and the plugin's maintainers have already shipped a fix in version 3.11.0.

Technical Details

How It Works

WooCommerce Bookings exposes an unauthenticated AJAX action used to calculate booking allocations. That handler reads a numeric parameter from the incoming request and uses it directly to decide how much memory to reserve for the calculation — without validating that the value is within a sane range.

An attacker can supply an arbitrarily large number in that parameter. The server then attempts to allocate a correspondingly massive block of memory to service the request, consuming available resources almost instantly. Because no upper bound is enforced, one request is enough to degrade or crash the PHP worker handling it, and a modest volume of repeated requests can take the entire site offline.

This is a distinct issue from CVE-2026-14853 (a missing authorization flaw in Bookings ≤ 3.8.0) and from the separate, previously disclosed unauthenticated DoS in WooCommerce core itself (fixed in 11.1.0, CVSS 7.5) — sites running both WooCommerce and WooCommerce Bookings should verify patch status for each independently.

Impact Assessment

Who Is At Risk

• Any WooCommerce store running WooCommerce Bookings before 3.11.0 with the plugin's AJAX endpoints reachable from the public internet — the normal deployment configuration for a storefront
• Shared-hosting WooCommerce sites, where memory exhaustion on one site can impact sibling tenants on the same host

Mitigation

Immediate Actions

• Update WooCommerce Bookings to version 3.11.0 or later.

  # Via WP-CLI
  wp plugin update woocommerce-bookings
   
  # Verify installed version
  wp plugin get woocommerce-bookings --field=version

  Copy

• Or update via WordPress Admin → Plugins → WooCommerce Bookings → Update Now.

• If immediate patching isn't possible, place rate limiting or a WAF rule in front of the plugin's booking-allocation AJAX action to cap request size and frequency.

Detection Opportunities

• Review PHP error logs and hosting resource-usage graphs for sudden memory-limit errors or OOM kills correlated with requests to the Bookings AJAX endpoint.
• Watch web server access logs for booking-allocation requests carrying unusually large numeric parameter values.

Defence-in-Depth

• Set conservative memory_limit values per PHP-FPM pool so a single runaway request can't starve the entire host.
• Enable a WAF or rate-limiting layer (Wordfence, Sucuri, Cloudflare) in front of any WooCommerce storefront, independent of this specific CVE.

Key Takeaways

1. CVE-2026-14854 affects WooCommerce Bookings before 3.11.0 and allows unauthenticated, single-request memory-exhaustion DoS.
2. No authentication or user interaction is required — the attack surface is a public AJAX action.
3. Fixed in version 3.11.0 — update immediately; this is distinct from the related CVE-2026-14853 authorization flaw and WooCommerce core's own separate DoS CVE.

References

• NVD — CVE-2026-14854
• Wordfence Intelligence — WooCommerce Bookings
• Strix — CVE-2026-14854: WooCommerce Bookings Denial of Service