CVE-2025-4691: Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'viewrequestdetails' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4691?
CVE-2025-4691 is rated as a medium severity vulnerability due to the risk of unauthorized access to sensitive data.
How do I fix CVE-2025-4691?
To fix CVE-2025-4691, update the eaSYNC Booking plugin to version 1.3.22 or later.
What type of vulnerability is CVE-2025-4691?
CVE-2025-4691 is classified as an Insecure Direct Object Reference vulnerability.
Who is affected by CVE-2025-4691?
All users of the eaSYNC Booking plugin for WordPress up to and including version 1.3.21 are affected by CVE-2025-4691.
What impact does CVE-2025-4691 have?
CVE-2025-4691 can allow attackers to access and manipulate sensitive request details without proper authorization.