Vulnerability · Published Oct 15, 2026 · Assigned by WPScan
CVE-2026-103304eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
Medium 5.3
In plain English
A medium-severity missing authorization in eaSYNC Booking from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | eaSYNC Booking | 0 – before 1.3.31 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/ exploit, vdb-entry, technical-description