CVE-2026-103304

UNKNOWN 0.0

eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

Vendor	unknown
Product	easync booking
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for unknown easync booking

Be the first to know when new unknown vulnerabilities affecting unknown easync booking are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / eaSYNC Booking

0 < 1.3.31

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/

Credits

Enrico Marcolini Claudio Marchesini Dottor Marc WPScan