Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N L N 5.3 .0031 23.8 —
AFFECTED Product Versions Fixed Easy Booking unspecified —
TIMELINE Jul 6 Reserved by WPScan Aug 6 Published (CNA: WPScan) Aug 7 EXPLOIT PUBLISHED — CVE-2026-14831 (Unknown Easy Booking). Public exploit reference added.
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
| Date | Event | Detail |
|---|---|---|
| July 6, 2026 | Reserved | Reserved by WPScan |
| August 6, 2026 | Published | Published (CNA: WPScan) |
| August 7, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-14831 (Unknown Easy Booking). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | Easy Booking | — | — | — |
Authoritative record: CVE-2026-14831 at cve.org
Weaknesses: CWE-602
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-14831 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.