Security Advisory

CVE-2025-4691

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-05-31 11:18:54

Last updated 2026-04-08 16:47:29

Assigner Wordfence

State PUBLISHED

Description

The Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the view_request_details due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21.

← Browse all CVEs View on cve.org ↗