CVE-2026-14831 — Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculatin…
Published: 2026-08-06 · CVSS: 5.3 · CVSS 3.1
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7