---
id: CVE-2026-103304
title: >-
  The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform
  authorization or nonce checks on several of its cancellation-related AJAX
  actions, allowing unauthenticated users to create booking cancellation
  requests, trigger bookin…
summary: >-
  The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform
  authorization or nonce checks on several of its cancellation-related AJAX
  actions, allowing unauthenticated users to create booking cancellation
  requests, trigger bookin…
severity: none
cwe:
  - CWE-862
product: eaSYNC Booking
affected:
  - easync_booking < 1.3.31
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:17:58.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103304'
references:
  - url: 'https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T06:56:27.298Z'
---

## Overview

The eaSYNC Booking  WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.