WordPress eaSYNC Booking plugin < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update vulnerability

Unauthenticated Cancellation Request Creation and Email Template Update vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin eaSYNC versions 1.3.31...

CVE-2026-103304 eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-5365

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the requestcancellation function. This makes it possible for unauthenticated attackers to cancel a logged-in customer's bookings v...