WooCommerce Bookings

WooCommerce Bookings has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 4.5, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (25%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 4 issues recorded for WooCommerce Bookings has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (2) reported by Mike Gozdiskowski.

Strategic Overview

Avg CVSSMedium

4.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WooCommerce Bookings vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-14854

WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service

Read the full analysis

Vulnerability Records

4 records


2026-10-09 00:00	WooCommerce Bookings <= 3.10.0 - Unauthenticated Denial of Service WooCommerce Bookings <= 3.10.0	`CVE-2026-14854`	5.3 Medium	Mike Gozdiskowski	Yes
2026-08-21 00:00	WooCommerce Bookings <= 3.8.0 - Missing Authorization WooCommerce Bookings <= 3.8.0	`CVE-2026-14853`	4.3 Medium	Mike Gozdiskowski	Yes
2023-11-14 00:00	WooCommerce Bookings <= 2.0.3 - Cross-Site Request Forgery WooCommerce Bookings <= 2.0.3	`CVE-2023-47787`	4.3 Medium	Rafie Muhammad	Yes
2023-05-15 00:00	WooCommerce Bookings <= 1.15.78 - Insecure Direct Object Reference WooCommerce Bookings <= 1.15.78	`CVE-2023-32747`	4.3 Medium	Rafie Muhammad	Yes

Showing 1–4 of 4 reports