The eaSYNC Booking WordPress plugin before version 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing an unauthenticated user to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends. This flaw permits unauthorized users to manipulate booking data and email templates, potentially causing loss of revenue, user confusion, or disclosure of sensitive contact information. The vulnerability is an example of improper access control.

This issue affects all installations of the eaSYNC Booking WordPress plugin for versions older than 1.3.31, regardless of the host site’s configuration. The plugin is distributed by the vendor "eaSYNC Booking".

The lack of authentication on publicly exposed AJAX endpoints makes exploitation trivial by anyone able to visit the site. Although no public exploit has been reported and the EPSS score is unavailable, the high impact coupled with the straightforward attack vector indicates a significant risk. The vulnerability is not listed in CISA’s KEV catalog, but its potential for widespread damage warrants immediate attention.