CVE-2025-4691

MEDIUM

Free Booking Plugin - Insecure Direct Object Reference

Title source: llm
STIX 2.1

Description

The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0012
EPSS Percentile 30.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (2)
syntactics/eaSYNC Booking – Hotels, Restaurants & Car Rentals < 1.3.21
syntacticsinc/easync < 1.3.22
Published May 31, 2025
Tracked Since Feb 18, 2026