Review
eaSYNC
CVE published 2026-10-15
CVE-2026-103304
The eaSYNC Booking WordPress plugin before 1.3.31 has a vulnerability allowing unauthenticated users to create booking cancellation requests and update email templates. This issue arises from the plugin's lack of authorization and nonce checks on certain AJAX actions. Affected product deployments should be reviewed for exposure, and defenders should prioritize updates to prevent unauthorized access. The C [truncated]