CVE-2026-103304 — eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

CVE-2026-103304

eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update PUBLISHED

Description (CNA)

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

Affected (CNA)

Vendor / product	Versions
Unknown / eaSYNC Booking	affected 0 before 1.3.31

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.