CVE-2026-14831
Medium
Description
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
SeverityMedium
CVSS5.3
Exploit probability—
ProductEasy Booking
PublishedAug 6, 2026
First seenAug 6, 2026
Weakness typeCWE-602CWE-602
How to fix
Update
- Easy Booking3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Booking | v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.