The eaSYNC Booking plugin for WordPress is affected by an insecure direct object reference that permits unauthenticated attackers to view the details of any booking request. The flaw arises from the 'view_request_details' endpoint lacking proper validation on a user‑supplied key, allowing sensitive data such as guest contact information, booking dates, and special requests to be exposed and compromising confidentiality.

All releases of the syntactics:eaSYNC Booking – Hotels, Restaurants & Car Rentals plugin for WordPress that are version 1.3.21 or earlier are affected. Versions 1.3.18 and 1.3.21 contain partial mitigations, but the core issue remains exploitable. Administrators using any of these versions should upgrade as soon as a fully patched release becomes available.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % suggests that the exploitation probability is low at present. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploitation. Based on the description, it is inferred that attackers can trigger the flaw without authentication by crafting URLs that reference the 'view_request_details' endpoint with valid request identifiers; thus the attack vector is a direct web request. Because sensitive booking information can be obtained, the primary risk lies in potential data exposure to unsuspecting users.