medium5.3
CVE-2026-103304
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing …
Impact
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Affected products
| Product | Affected versions |
|---|---|
| EaSYNC Booking WordPress Plugin | before 1.3.31 |
Versions were read from the advisory text. No structured product data has been published for this record yet.