All vulnerabilities
CVE-2026-103304

eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

Unknown eaSYNC Booking
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.3.31Fixed versionCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

Text from CVE List

Affected versions 1

  • eaSYNC Bookingaffected: all versions before 1.3.31CVE List

References 1