eaSYNC Booking CVE-2026-103304

No authentication or user interaction is required: the vulnerable code paths are several cancellation-related AJAX actions of the eaSYNC Booking plugin that perform neither authorization nor nonce validation, so any unauthenticated visitor who can reach the site's admin-ajax endpoint can invoke them against a default installation of a vulnerable version (before 1.3.31). The principal limiting factors are that the target site must run the eaSYNC Booking plugin at an affected version and must be internet-reachable, and that impact is confined to creating cancellation requests, triggering notification emails, and overwriting email content - there is no direct code execution, data disclosure, or site takeover.

This is a genuine but moderate-priority web application flaw, not a high-impact server compromise. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects a network-reachable, low-complexity, unauthenticated issue requiring no user interaction, but the impact is deliberately scoped to integrity only (C:N/I:L/A:N), yielding a base score of 5.3 (Medium). Publicly available exploit code exists (reported by WPScan), which raises the practical likelihood of opportunistic abuse, especially given automated WordPress plugin scanning. However, there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active, widespread exploitation - the POC signal and the absence of KEV together suggest opportunistic nuisance/abuse potential rather than confirmed in-the-wild campaigns. The CWE-862 (Missing Authorization) root cause is consistent with the description's missing nonce/authorization checks. Net: real but bounded - the lack of confidentiality or availability impact and the integrity-only scope mean this is a legitimate hygiene fix rather than an emergency, though the unauthenticated + public-POC combination warrants prompt patching on exposed sites.

An unauthenticated attacker sends crafted AJAX requests to the plugin's cancellation-related endpoints, which lack nonce and authorization checks, to forge booking cancellation requests and trigger notification emails to site operators or customers. Because the content of those emails can be overwritten, the attacker can abuse the site as a conduit for misleading or malicious email content and spam. A public proof-of-concept exists (WPScan), lowering the skill barrier for exploitation.