Insecure Direct Object Reference in eaSYNC Booking Plugin for WordPress
CVE-2025-4691
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 May 2025
What is CVE-2025-4691?
The eaSYNC Booking Plugin for WordPress is susceptible to an Insecure Direct Object Reference (IDOR), affecting all versions up to and including 1.3.21. This vulnerability stems from insufficient validation of a user-controlled key during the 'view_request_details' functionality, allowing unauthorized individuals to access sensitive booking request details without prior authentication. While partial mitigations were introduced in versions 1.3.18 and 1.3.21, the issue remains critical for users running vulnerable versions of the plugin.
Affected Version(s)
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking * <= 1.3.21