Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC, CVE-2025-4691
- CVE, Research URL
- Home page URL
-
Security reports for Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC
- Published on
- May 31, 2025
- Research Description
- The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.
- Affected versions
-
Min -, max 1.3.22.
- Status
-
vulnerable
| Previous vulnerability researches |
|---|
| WordPress Tabs (CVE-2025-46522) , Apr 26, 2025 |