The WooCommerce Bookings WordPress plugin before version 3.11.0 allows attackers to supply an arbitrary size value in one of its unauthenticated AJAX actions without validation, causing the plugin to allocate that amount of memory. This uncontrolled allocation can exhaust the server’s RAM, leading to a denial of service with a single crafted request. The flaw reflects input validation failures that enable uncontrolled resource consumption (CWE‑400) and directly impacts the availability of affected WordPress sites.

Every deployment of WooCommerce Bookings prior to version 3.11.0 across all WordPress websites is vulnerable, regardless of the specific WordPress version or hosting configuration.

The vulnerability’s lack of authentication requirements combined with the ability to cause memory exhaustion produces a severe availability impact. The EPSS score is <1% (approximately 0.0016), indicating a low to moderate probability of exploitation, but the simplicity of the exploit and absence of defensive controls suggest a high likelihood of exploitation in a targeted or opportunistic scenario. The CVSS score is 7.5, indicating substantial potential for service disruption. The vulnerability is not listed in the CISA KEV catalog.