CVE-2026-14854

Executive Summary

CVE-2026-14854 is an unauthenticated memory-exhaustion denial-of-service vulnerability in the WooCommerce Bookings WordPress plugin affecting all versions prior to 3.11.0. The flaw resides in one of the plugin's unauthenticated AJAX actions, where a user-supplied value is passed to a memory allocation routine without any upper-bound validation. A single crafted request from an unauthenticated attacker can exhaust server memory and render the target WordPress site unavailable.

Technical Analysis

The vulnerability is classified as CWE-770, Allocation of Resources Without Limits or Throttling. According to the NVD description, the WooCommerce Bookings plugin "does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions." This means the vulnerable code path accepts an attacker-controlled input value (for example, a numeric size, count, or length parameter submitted through an AJAX request) and uses it directly — or with insufficient bounding — as the size argument for a memory allocation operation.

The critical characteristics of this flaw are:

1. Unauthenticated reachability. The affected AJAX action is registered in a manner that allows it to be invoked without authentication. In the WordPress AJAX architecture, this typically corresponds to actions registered via the wp_ajax_nopriv_* hook pattern, which serves requests from users who are not logged in. The NVD description explicitly states the action is "unauthenticated," confirming that no session, nonce validated against an authenticated user, or capability check prevents access.

2. Unbounded allocation. The user-supplied value is not capped before being used to allocate memory. Without a limit, an attacker can supply an extremely large value, causing the PHP process (or underlying interpreter) to request an equally large region of memory. On typical shared or constrained hosting, this rapidly exceeds available memory and terminates the process.

3. Single-request triggerability. The description states that a single request is sufficient to "exhaust server memory and cause a Denial of Service." This distinguishes the flaw from volumetric attacks requiring many concurrent connections; here, the amplification is intrinsic to the unchecked allocation itself.

4. Class-level attack surface. The underlying mechanism is a classic resource-exhaustion / memory-amplification pattern: uncontrolled input is fed to an allocation primitive, and the impact is availability degradation rather than confidentiality or integrity loss. No code execution, data disclosure, or privilege escalation is described.

Because the NVD description is sparse and does not name the specific AJAX action, parameters, or functions involved, the precise code-level implementation cannot be confirmed from the available data. No CVE-assigned CVSS score is available (NVD lists the score as N/A), so impact severity must be inferred from the vulnerability class: an unauthenticated, remotely triggerable availability impact typically maps to a high availability subscore (A:H) under CVSS v3.1, with no confidentiality or integrity impact.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class and the NVD description. No public proof-of-concept, exploit code, or Nuclei template is available, so the chain is presented at the vulnerability-class level. No specific function names, endpoint paths, or parameter names beyond those implied by the description ("unauthenticated AJAX action") are asserted.

1. Reconnaissance / target identification. An attacker identifies a WordPress site running the WooCommerce Bookings plugin at a version prior to 3.11.0. Fingerprinting can be performed passively by inspecting publicly served plugin assets (HTML, CSS, or JavaScript referencing the plugin's directory) or actively by probing known plugin paths. Public sources such as plugin version-readme exposure or asset enumeration can reveal the installed version, confirming vulnerability.

2. Triggering the flaw class. The attacker crafts a request to the unauthenticated AJAX action. At the vulnerability-class level, the request supplies an oversized value in the field that the plugin forwards into a memory allocation call. Because no upper bound is enforced, the supplied value directly dictates the amount of memory requested.

3. Payload / execution method (class level). The payload is an HTTP request to the site's AJAX entry point carrying the oversized parameter. No authentication token, session, or valid nonce tied to an authenticated user is required, consistent with the description's "unauthenticated" characterization. The attacker need not chain any secondary vulnerability.

4. Post-exploitation impact. Upon processing, the script attempts to allocate memory sized by the attacker-controlled value, exhausting available memory for the worker process and potentially the server itself. The result is a denial of service: the site becomes unresponsive or returns server errors. Per the description, a single request is sufficient, so the attacker may sustain denial by repetition, but even one request can achieve the stated effect.

No public exploit is available; this scenario is inferred from the vulnerability class (unbounded resource allocation). Speculative function names and parameter names are deliberately omitted because they are not present in the source data.

Impact Assessment

The impact is primarily availability. According to the vulnerability class and the description:

• Availability (High). The unchecked allocation can exhaust server memory and cause denial of service with a single unauthenticated request. This is consistent with a high availability impact rating.
• Confidentiality (None). The description makes no mention of data exposure, so no confidentiality impact is asserted.
• Integrity (None). The description makes no mention of data modification, so no integrity impact is asserted.

Blast radius depends on deployment architecture. On shared hosting, memory exhaustion in a single PHP worker may affect other tenants on the same server. On dedicated or containerized deployments, the affected process may be killed or the container may be OOM-terminated, degrading or halting the WooCommerce storefront and its booking functionality. Because the attack is unauthenticated and requires only one request, the barrier to exploitation is extremely low, enabling opportunistic disruption without credentials or specialized tooling. The lack of any published CVSS score (N/A) means consumers of this advisory should apply their own environmental scoring, but the unauthenticated, remotely triggerable, single-request denial-of-service nature warrants treatment as a high-priority availability risk.

Detection Guidance

Sigma Rule

title: WooCommerce Bookings Unauthenticated Memory Exhaustion (CVE-2026-14854)
id: 9b6a2f5c-7c1e-4f2a-8d3b-0a1f2e3c4d5e
status: experimental
description: Detects attempts to exploit the unauthenticated AJAX memory-exhaustion flaw in WooCommerce Bookings before 3.11.0 via oversized parameters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14854
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_ajax:
    cs-uri-query|contains: 'admin-ajax.php'
  selection_action:
    cs-uri-query|contains: 'action='
  selection_large_value:
    cs-uri-query|re: '[0-9]{7,}'
  condition: selection_method and selection_ajax and selection_action and selection_large_value
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate large numeric values in unrelated AJAX requests
level: high

YARA Rule

rule CVE_2026_14854_WooCommerce_Bookings_Memory_Exhaustion
{
    meta:
        description = "Detects requests attempting to exploit unauthenticated memory-exhaustion in WooCommerce Bookings before 3.11.0"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14854"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ajax = "admin-ajax.php" ascii wide nocase
        $action = "action=" ascii wide nocase
        $booking = "bookings" ascii wide nocase
        $bigval = /[0-9]{7,}/

    condition:
        uint16(0) == 0x4850 and
        $ajax and $action and $booking and $bigval
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14854 WooCommerce Bookings Unauthenticated Memory Exhaustion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; content:"action="; pcre:"/[0-9]{7,}/U"; reference:cve,2026-14854; classtype:attempted-dos; sid:202614854; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where http.request.method == "POST" and
   http.request.uri contains "admin-ajax.php" and
   http.request.uri contains "action=" and
   http.request.uri regex~ "[0-9]{7,}"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri="*admin-ajax.php*" uri="*action=*"
| regex uri="[0-9]{7,}"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,woocommerce,attack,">
  <rule id="100854" level="12">
    <if_sid>31100</if_sid>
    <id>^400</id>
    <match>admin-ajax.php</match>
    <match>action=</match>
    <regex>[0-9]{7,}</regex>
    <description>CVE-2026-14854: Possible WooCommerce Bookings unauthenticated memory exhaustion attempt from $(srcip)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_14854,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (applied before an update is available):

   • Update WooCommerce Bookings to version 3.11.0 or later, which the NVD description indicates resolves the issue by bounding the value. Where an update cannot yet be applied, treat the plugin as at risk.
   • Restrict or disable the affected plugin functionality if it is not operationally required.
   • Add a Web Application Firewall (WAF) or reverse-proxy rule that rejects requests to admin-ajax.php carrying oversized numeric values, rate-limits unauthenticated AJAX traffic, and blocks anomalous request patterns.
   • Enforce per-process memory limits (PHP memory_limit) so that an oversized allocation fails gracefully and does not take down neighboring services.
   • Deploy monitoring and alerting on server memory pressure and HTTP 500/502 spikes to detect in-progress exhaustion.

2. Patch / upgrade steps:

   • Back up the site and database before making changes.
   • Update WooCommerce Bookings to version 3.11.0 or later through the WordPress plugin update mechanism or via a trusted distribution channel.
   • Verify the installed version post-update and confirm the plugin changelog includes the fix.
   • Re-test the affected unauthenticated AJAX action in a staging environment to confirm the bound is enforced.
   • Because no vendor fix is confirmed by tracked patch sources (patch confidence 0/4), independently validate the fix against the NVD advisory before relying solely on the version number.

3. Long-term hardening:

   • Maintain a patch-management cadence with automated vulnerability scanning for WordPress plugins.
   • Enforce strict input validation, including explicit maximum values, for any user-supplied input used in memory allocation or resource sizing.
   • Apply the principle of least privilege to unauthenticated AJAX actions; require nonces and capability checks wherever authentication is feasible.
   • Deploy WAF and rate-limiting at the edge as a defense-in-depth control for resource-exhaustion flaws.
   • Enable memory pressure monitoring and OOM-event alerting to shorten detection and response time for similar availability attacks.

References

• NVD — CVE-2026-14854: https://nvd.nist.gov/vuln/detail/CVE-2026-14854
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• WooCommerce Bookings official product page (vendor patch reference, verify version 3.11.0): https://woocommerce.com/products/woocommerce-bookings/
• Wordfence / WPScan vulnerability databases (monitor for updated advisory and any exploit-in-the-wild reporting): https://www.wordfence.com/threat-intel/

Note on threat intelligence: No public proof-of-concept, Nuclei template, or exploit code has been observed for CVE-2026-14854, and the vulnerability has not been added to CISA KEV. No known threat actor campaigns or confirmed in-the-wild exploitation have been reported for this CVE.