Description

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-23T06:17:16.143Z",
  "pubdate": "2026-08-23T06:17:16.143Z",
  "executiveSummary": "The WooCommerce Bookings WordPress plugin before version 3.9.0 suffers from an authorization bypass vulnerability affecting one of its AJAX action handlers. This security flaw stems from an absent capability check and a flawed nonce verification mechanism that can be completely bypassed by omitting the validation token entirely.\nThe impact of this vulnerability allows authenticated remote attackers possessing minimal privileges, specifically users assigned the Subscriber-level role, to execute unauthorized AJAX requests and instantiate draft bookable products within the targeted WordPress database. This compromises the integrity of the application's catalog and data management controls.\nThe risk implication involves unauthorized modification of site content and potential abuse of backend processing workflows by low-privileged users. The attacker capability is restricted to creating draft products, but requires active user authentication at the Subscriber tier. No specific advanced exploitation requirements exist beyond invoking the vulnerable AJAX endpoint with modified parameters while omitting the security token.",
  "technicalDetails": "The vulnerability resides within the AJAX action handling mechanism of the WooCommerce Bookings plugin for WordPress, specifically impacting versions prior to 3.9.0. The root cause of the flaw is twofold: an absolute omission of proper capability checks to verify whether the invoking user possesses the administrative or editorial privileges required to create products, and a poorly implemented nonce validation routine.\nThe nonce check vulnerability manifests because the verification logic improperly handles the absence of the security token. When the token parameter is completely omitted from the HTTP request, the validation check fails securely or evaluates incorrectly in a manner that allows the execution flow to bypass the security control entirely.\nThe attack flow proceeds as follows: An authenticated attacker with Subscriber-level privileges initiates an HTTP POST request targeted at the WordPress admin-ajax.php endpoint, specifying the vulnerable action parameter associated with the WooCommerce Bookings plugin. Because the backend code fails to validate user capabilities against the requested action, and because the nonce check is bypassed by omitting the token, the application processes the request as if it originated from an authorized user.\nConsequently, the vulnerable component executes the underlying function responsible for product instantiation, resulting in the unauthorized creation of a new draft bookable product within the database. The network exposure is limited to the standard WordPress web interface, requiring the attacker to maintain an active Subscriber session. Post-exploitation impact is constrained to unauthorized content creation, specifically polluting the product database with draft entries that may require manual cleanup by administrators."
}