CVE-2026-103304mediumCWE-862

CVE-2026-103304: medium-severity vulnerability in eaSYNC Booking

eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

Published

Follow this CVE+ Monitor eaSYNC Booking

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · eaSYNC Booking
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.