CVE-2025-4691
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.
Reserved 2025-05-14 | Published 2025-05-31 | Updated 2025-06-02 | Assigner WordfenceCWE-639 Authorization Bypass Through User-Controlled Key
| 2025-05-30: | Disclosed |
Jaynel Patiarba
www.wordfence.com/...-dd09-4c80-be11-4daf3bbac720?source=cve
plugins.trac.wordpress.org/...booking/tags/1.3.17/easync.php
plugins.trac.wordpress.org/changeset/3243634/
plugins.trac.wordpress.org/changeset/3293607/
plugins.trac.wordpress.org/changeset/3300408/
Support options
