The eaSYNC Booking plugin, a widely used tool for managing reservations in hotels, restaurants, and car rental services on WordPress platforms, has been found to contain a significant security vulnerability. This flaw, categorized as an Insecure Direct Object Reference (IDOR), allows unauthorized individuals to gain access to private booking request details without needing to authenticate or log in. This means that personal and reservation information could be exposed, posing a serious privacy risk for businesses and their customers. The issue stems from insufficient validation on a user-controlled key within the plugin’s `view_request_details` function, making it possible for an attacker to simply change a parameter to view different booking records.
CVE Details
This particular vulnerability is officially cataloged under the identifier CVE-2025-4691.
Product: Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking for WordPress
Published: May 31, 2025
Severity: Medium
Status: Analyzed
Affected Products
The Insecure Direct Object Reference vulnerability impacts all versions of the Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking for WordPress up to, and including, version 1.3.21. If your WordPress website utilizes this plugin for any booking or reservation purposes and is running a version within this range, it is potentially susceptible to this data exposure risk. It is crucial for website administrators to identify their current plugin version to understand their exposure.
Current Status
The status of this vulnerability is “Analyzed.” This indicates that security experts have thoroughly investigated and confirmed the presence and nature of the flaw. The analysis helps in understanding the root cause and potential impact, paving the way for effective remediation efforts.
Severity Level
With a CVSS (Common Vulnerability Scoring System) score of 5.3, this vulnerability is classified as “Medium” severity. A medium rating signifies that while the exploit might not lead to full system compromise or immediate financial loss in all cases, it can still have notable negative consequences. In the context of CVE-2025-4691, the ability for unauthenticated attackers to view sensitive booking request details translates directly into a privacy breach. This could include customer names, contact information, and specific reservation details, potentially damaging an organization’s reputation and trust with its clients. Therefore, even though it’s not “critical,” addressing a medium-severity IDOR promptly is vital for data protection and maintaining user confidence.
Possible Solutions
The good news is that the developers of the eaSYNC Booking plugin have responded to this vulnerability by releasing updates. The description states that the vulnerability was partially patched in versions 1.3.18 and 1.3.21. To secure your WordPress site, it is strongly recommended to update your eaSYNC Booking plugin to the latest available stable version immediately. Updating to a patched version will close the loophole that allows unauthorized access to booking data. As a best practice, always back up your WordPress site and its database before performing any plugin or theme updates to prevent potential data loss and ensure a smooth transition. Regularly checking for and applying plugin updates is a cornerstone of maintaining a secure WordPress environment.
References
https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859
https://plugins.trac.wordpress.org/changeset/3243634/
https://plugins.trac.wordpress.org/changeset/3293607/
https://plugins.trac.wordpress.org/changeset/3300408/
https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve
