CVE-2025-4691 Information

Description

The Free Booking Plugin for Hotels Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.3.21 via the ‘view_request_details’ due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Reference

https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859 https://plugins.trac.wordpress.org/changeset/3243634/ https://plugins.trac.wordpress.org/changeset/3293607/ https://plugins.trac.wordpress.org/changeset/3300408/ https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

NONE

Base Score

NONE

Base Severity

5.3