CVE-2026-103304 — eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated u…
Published: 2026-10-15 · CVSS: 5.3 · CVSS 3.1
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7