CVE-2025-4691

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4691", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-14T15:45:37.633Z", "datePublished": "2025-05-31T11:18:54.731Z", "dateUpdated": "2026-04-08T16:47:29.012Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:29.012Z"}, "affected": [{"vendor": "syntactics", "product": "eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21."}], "title": "Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859"}, {"url": "https://plugins.trac.wordpress.org/changeset/3243634/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3293607/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3300408/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jaynel Patiarba"}], "timeline": [{"time": "2025-05-30T21:32:30.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T15:38:06.300348Z", "id": "CVE-2025-4691", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T15:48:20.006Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T15:38:06.300348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T15:17:00.510Z"}}], "cna": {"title": "Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Jaynel Patiarba"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "syntactics", "product": "eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.21"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-30T21:32:30.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859"}, {"url": "https://plugins.trac.wordpress.org/changeset/3243634/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3293607/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3300408/"}], "descriptions": [{"lang": "en", "value": "The Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:47:29.012Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4691", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:47:29.012Z", "dateReserved": "2025-05-14T15:45:37.633Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-31T11:18:54.731Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals", "vendor": "syntactics", "versions": [{"lessThanOrEqual": "1.3.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7E79CC81-577D-4D70-A760-3D3FD7AA4128", "versionEndExcluding": "1.3.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.21 via the 'view_request_details' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the details of any booking request. The vulnerability was partially patched in versions 1.3.18 and 1.3.21."}, {"lang": "es", "value": "El complemento Free Booking Plugin for Hotels, Restaurants and Car Rentals \u2013 eaSYNC Booking para WordPress es vulnerable a una referencia directa a objetos insegura en todas las versiones hasta la 1.3.21 (incluida) a trav\u00e9s de 'view_request_details' debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto permite que atacantes no autenticados vean los detalles de cualquier solicitud de reserva. La vulnerabilidad se corrigi\u00f3 parcialmente en las versiones 1.3.18 y 1.3.21."}], "id": "CVE-2025-4691", "lastModified": "2026-06-17T09:33:47.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4691", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-02T15:38:06.300348Z", "version": "2.0.3"}}]}, "published": "2025-05-31T12:15:20.133", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/easync-booking/tags/1.3.17/easync.php#L4859"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3243634/"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3293607/"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3300408/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c9953b3-dd09-4c80-be11-4daf3bbac720?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T04:10:12.083669+00:00", "value": {"mitigation_remediation": ["Update the plugin to the latest stable release that fully resolves the direct object reference issue.", "Restrict access to the 'view_request_details' endpoint by configuring plugin settings or server rules so that only authenticated administrators can invoke it, thereby mitigating accidental or malicious exposure.", "Conduct a security review of all other plugins and custom code for similar Insecure Direct Object Reference patterns, and run regular vulnerability scans to detect any future exposures."], "summary": {"action": "Update Now", "impact": "Information Disclosure of Booking Details"}, "threat_synthesis": {"affected_systems": "All releases of the syntactics:eaSYNC Booking \u2013 Hotels, Restaurants & Car Rentals plugin for WordPress that are version 1.3.21 or earlier are affected. Versions 1.3.18 and 1.3.21 contain partial mitigations, but the core issue remains exploitable. Administrators using any of these versions should upgrade as soon as a fully patched release becomes available.", "description_and_impact": "The eaSYNC Booking plugin for WordPress is affected by an insecure direct object reference that permits unauthenticated attackers to view the details of any booking request. The flaw arises from the 'view_request_details' endpoint lacking proper validation on a user\u2011supplied key, allowing sensitive data such as guest contact information, booking dates, and special requests to be exposed and compromising confidentiality.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1\u202f% suggests that the exploitation probability is low at present. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploitation. Based on the description, it is inferred that attackers can trigger the flaw without authentication by crafting URLs that reference the 'view_request_details' endpoint with valid request identifiers; thus the attack vector is a direct web request. Because sensitive booking information can be obtained, the primary risk lies in potential data exposure to unsuspecting users."}}}}, "created": "2026-04-22T04:15:07.538496+00:00", "updated": "2026-04-22T04:15:07.538507+00:00", "vendors": []}