{
 "id": "WPSEC-2026-0649",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0649/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0649/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0649/index.md",
 "title": "WooCommerce Accommodation Bookings <= 1.3.12 - Unauthenticated Denial of Service via Availability Cache Registry",
 "description": "The WooCommerce Accommodation Bookings plugin for WordPress is vulnerable to uncontrolled resource consumption in versions 1.1.8 up to, and including, 1.3.12. This is due to the get_time_slots() function adding its cache key to the shared 'booking_slots_transient_keys' registry on every availability lookup, including lookups served from cache, with no deduplication or size limit, and rewriting the entire registry each time. This makes it possible for unauthenticated attackers to inflate the registry by repeatedly requesting availability for an accommodation product, increasing the database and memory cost of every later availability lookup and degrading site performance.",
 "plugin": {
  "slug": "woocommerce-accommodation-bookings",
  "name": "WooCommerce Accommodation Bookings",
  "full_name": "WooCommerce Accommodation Bookings",
  "wordpress_org": "https://wordpress.org/plugins/woocommerce-accommodation-bookings/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woocommerce-accommodation-bookings/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woocommerce-accommodation-bookings"
 },
 "type": "DOS",
 "cwe": [
  "CWE-770"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.1.8",
    "from_inclusive": true,
    "to": "1.3.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.1.8 before 1.3.13"
  ]
 },
 "introduced_in": "1.1.8",
 "fixed_in": "1.3.13",
 "remediation": "Update to 1.3.13 or later.",
 "fix_released": "2026-10-07T11:57:44+00:00",
 "published": "2026-10-08T12:49:15+00:00",
 "updated": "2026-10-07T16:15:13.967838+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0649/",
  "https://plugins.svn.wordpress.org/woocommerce-accommodation-bookings/tags/1.3.13/",
  "https://wordpress.org/plugins/woocommerce-accommodation-bookings/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woocommerce-accommodation-bookings",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}