[ CVE-2026-103304 · Published 15 Oct 2026 ]
Vulnerability in Unknown eaSYNC Booking
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.