Easync Booking
Monthly
Unauthenticated attackers can invoke several cancellation-related AJAX actions in the eaSYNC Booking WordPress plugin before 1.3.31 because those actions lack authorization and nonce validation, letting them create booking cancellation requests, fire booking notification emails, and overwrite the content of emails the site sends. Publicly available exploit code exists (the WPScan advisory is the exploit reference), but there is no indication of confirmed active exploitation in CISA KEV. The impact is confined to integrity of booking state and outbound email content - there is no code execution, data disclosure, or site takeover - making this a moderate-priority web application flaw (CVSS 5.3).
Unauthenticated attackers can invoke several cancellation-related AJAX actions in the eaSYNC Booking WordPress plugin before 1.3.31 because those actions lack authorization and nonce validation, letting them create booking cancellation requests, fire booking notification emails, and overwrite the content of emails the site sends. Publicly available exploit code exists (the WPScan advisory is the exploit reference), but there is no indication of confirmed active exploitation in CISA KEV. The impact is confined to integrity of booking state and outbound email content - there is no code execution, data disclosure, or site takeover - making this a moderate-priority web application flaw (CVSS 5.3).