Easy Booking – WooCommerce Booking & Reservation Plugin

Easy Booking – WooCommerce Booking & Reservation Plugin has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Improper Input Validation, behind 1 of the records (100%).

The one issue recorded for Easy Booking – WooCommerce Booking & Reservation Plugin has a vendor fix available, so running the current release closes it.

All of these findings were reported by marim00. Easy Booking – WooCommerce Booking & Reservation Plugin is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Easy Booking – WooCommerce Booking & Reservation Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-14831

Easy Booking <= 3.4.0 - Unauthenticated Minimum Booking Bypass

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Easy Booking – WooCommerce Booking & Reservation Plugin banner
Latestv3.5.8

Easy Booking – WooCommerce Booking & Reservation Plugin

Noushka

Author

Noushka

4.7(63)
94/100
Last Updated
2026-10-29 (4d ago)
Active Installs
4,000+
Downloads
356,900
Requires WP
6.0+
Requires PHP
0+
Tested up to
WP 7.1.4
Created
2014-05-13 (13y ago)
Requires Plugins
woocommerce

Easy Booking is a powerful yet intuitive WooCommerce booking and rental plugin, fully compatible with simple, variable, grouped, and bundle products. Flexible booking modes: Choose between Days or Nights mode, and set custom booking durations and limits. Date selection: offer single or dual-date bookings (e.g., check-in/check-out). Dashboard management: Easily track and manage processing or upcoming bookings directly from your WordPress admin. Developer-friendly: Extend functionality with filters and action hooks. Perfect for rentals, event bookings, or any date-based service. Official website | Demo | Documentation | FAQ Why choose Easy Booking? No complex setup: Works natively with WooCommerce, no extra product types or complicated configurations. Adaptable: Whether you rent equipment, manage event registrations, or offer seasonal services, Easy Booking adjusts to your workflow. Responsive support & clear documentation : Get help when you need it, with detailed documentation and a quick, friendly developer ready to assist you. Upgrade to Easy Booking PRO for advanced features Stock management by date: Automatic availability management for each date individually, ensuring no overbookings. Disabled dates: Block specific dates (holidays, closures, etc.). Advanced pricing: Set prices by date, season, or booking duration. Date selection on shop page: Let customers choose dates directly from the product listing, with real-time filtering of available products. Manual booking import: Add reservations manually without creating orders, ideal for phone bookings or external systems. Learn more about Easy Booking PRO. Looking for time-based bookings instead? Easy Booking focuses on rentals, accommodations, and date-based bookings without time selection. For appointments, services, classes, and bookings with time slots, take a look at Easy Scheduling. Demo See Easy Booking in action: Check out the demo and explore all the features. Developer notes Public price calculation endpoint POST /wp-json/easybooking/v1/date-selection/ is a public, read-only endpoint for calculating booking prices and displaying booking details and availability. It no longer requires a nonce or a `security` field. The request method, booking parameters, response format and existing hooks are unchanged. Callbacks attached to this calculation, including easy_booking_sanitized_booking_data, price filters, easy_booking_selected_quantity and easy_booking_fragments, can run for anonymous visitors with visitor-supplied data. Keep these callbacks read-only: do not create bookings, reserve stock, modify the cart or perform privileged operations in them. Neither reaching a hook nor receiving a legacy nonce proves authorization. Sensitive operations belong in a separate endpoint with appropriate server-side permissions, input validation and CSRF protection. Server-side booking validation and cart price calculation remain in place. The displayed price is not trusted as the cart price. The legacy /easybooking/v1/get-fresh-nonce/ endpoint, PHP nonce helpers and JavaScript DynamicNonce export remain available for cached scripts and existing integrations, but the current price calculation no longer uses them. Integrations can stop requesting or sending this nonce for price calculations.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C