CVE-2026-103304: eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eaSYNC Booking WordPress pluginto a version that resolves this vulnerability.Fixed in 1.3.31
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Sites using the eaSYNC Booking WordPress plugin at a version earlier than 1.3.31 are affected.
Does an attacker need a WordPress account or a valid request token?
No. The affected AJAX actions lack authorization and nonce checks, so unauthenticated users can invoke them.
What could an unauthenticated attacker do through the affected actions?
They can create booking cancellation requests, trigger booking notification emails, and overwrite the content of emails sent by the site.