{"id":"CVE-2026-103304","aliases":["EUVD-2026-101849","GHSA-pqxc-w2xw-35h9"],"status":"published","title":"eaSYNC \u003c 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update","description":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00221,"percentile":0.12803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-10-15T06:00:13Z","modified":"2026-10-15T14:47:05Z","products":[{"vendor":"unknown","product":"easync booking"}],"references":[{"url":"https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103304"},{"url":"https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a"},{"url":"https://github.com/advisories/GHSA-pqxc-w2xw-35h9"}],"sources":{"cve":[{"id":"CVE-2026-103304","title":"eaSYNC \u003c 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update","description":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.","status":"published","published":"2026-10-15T06:00:13.29Z","modified":"2026-10-15T11:01:27.685Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-101849","description":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.","status":"published","published":"2026-10-15T06:00:13Z","modified":"2026-10-15T11:01:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:15.076272Z"}],"ghsa":[{"id":"GHSA-pqxc-w2xw-35h9","title":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks...","description":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.","status":"published","published":"2026-10-15T09:30:32Z","modified":"2026-10-15T12:31:00Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:13:35.825754Z"}],"nvd":[{"id":"CVE-2026-103304","description":"The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.","status":"published","published":"2026-10-15T07:17:58.113Z","modified":"2026-10-15T14:47:05.72Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:59.328869Z"}]}}