The affected WooCommerce Bookings plugin does not perform a capability check for an AJAX action that creates new bookable products, and its nonce check can be bypassed by omitting the token. A user with a Subscriber role or higher can therefore trigger this action and create draft bookable products. This flaw allows an attacker to introduce malicious or spam bookable items without supervision, potentially disrupting the e‑commerce experience, violating business rules, or enabling further attacks if the products contain harmful links or code.

All WordPress sites running WooCommerce Bookings versions earlier than 3.9.0 are vulnerable. Any user who can authenticate as a Subscriber or higher has the ability to exploit the missing authorization check.

Because the exploitation requires only a normal authenticated web user with Subscriber-level or higher privileges, the attack vector is straightforward and does not require special access or technical knowledge beyond logging into the site. While EPSS for this vulnerability is not available and it is not listed in the CISA KEV catalog, the impact of successfully creating draft products can be significant for site integrity and business operations. The lack of a CVSS score in the public data does not diminish the likelihood of exploitation; a straightforward web request to the vulnerable endpoint is sufficient to generate the unauthorized content.