CVE-2025-4691 Overview
CVE-2025-4691 affects the Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking plugin for WordPress. The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.3.21. The flaw exists in the view_request_details functionality due to missing validation on a user-controlled key. Unauthenticated attackers can view the details of any booking request stored by the plugin. The vendor released partial patches in versions 1.3.18 and 1.3.21, but coverage remained incomplete across affected releases.
Critical Impact
Unauthenticated attackers can enumerate booking identifiers and disclose confidential customer reservation data submitted through the eaSYNC Booking plugin.
Affected Products
- Syntacticsinc eaSYNC Booking plugin for WordPress, all versions up to and including 1.3.21
- Partially patched in 1.3.18
- Partially patched in 1.3.21
Discovery Timeline
- 2025-05-31 - CVE-2025-4691 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4691
Vulnerability Analysis
The vulnerability is classified as an Insecure Direct Object Reference [CWE-639]. The view_request_details handler accepts a user-supplied identifier and returns the corresponding booking record without verifying that the requester is authorized to access the referenced object. Because the endpoint is reachable without authentication, any remote client can iterate through booking identifiers and retrieve details for arbitrary reservations. Disclosed data may include customer names, contact information, booking dates, and reservation specifics submitted to hotels, restaurants, or car rental operators using the plugin.
Root Cause
The root cause is missing access control validation on a user-controlled key parameter. The plugin trusts the identifier supplied in the request and returns matching booking data directly from the database. There is no session check, capability check, or ownership check between the requesting client and the requested booking record. Versions 1.3.18 and 1.3.21 introduced partial mitigations, but the underlying authorization gap in the view_request_details code path was not fully closed.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the vulnerable WordPress site targeting the view_request_details action with sequential or guessed identifiers. Each successful request returns booking details for the referenced record. The vulnerability does not permit modification or deletion of records, limiting the impact to confidentiality of stored booking data.
See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical references.
Detection Methods for CVE-2025-4691
Indicators of Compromise
- Repeated unauthenticated HTTP requests to WordPress admin-ajax or plugin endpoints invoking the view_request_details action.
- Sequential or brute-forced numeric identifier values in query or POST parameters targeting the eaSYNC Booking plugin.
- Unusual outbound data volume from the WordPress host correlating with booking record access.
Detection Strategies
- Review web server access logs for high-frequency requests to eaSYNC Booking plugin endpoints from a single source address.
- Alert on unauthenticated sessions accessing booking detail actions that should require an authenticated administrator context.
- Deploy a Web Application Firewall (WAF) rule to flag enumeration patterns against the view_request_details parameter.
Monitoring Recommendations
- Enable WordPress audit logging for plugin AJAX actions and preserve logs for forensic review.
- Monitor plugin version inventory to identify sites running eaSYNC Booking 1.3.21 or earlier.
- Correlate WordPress access telemetry with edge WAF logs to identify enumeration attempts across the estate.
How to Mitigate CVE-2025-4691
Immediate Actions Required
- Identify all WordPress installations running the eaSYNC Booking plugin at version 1.3.21 or earlier.
- Restrict public access to the view_request_details endpoint via WAF rules until a full patch is available.
- Audit booking data access logs for signs of enumeration or unauthorized retrieval.
Patch Information
The vendor released partial fixes in versions 1.3.18 and 1.3.21. Administrators should apply the latest available version and monitor the plugin repository for a complete fix. Refer to the vendor commits: WordPress Changeset #3243634, WordPress Changeset #3293607, and WordPress Changeset #3300408.
Workarounds
- Disable the eaSYNC Booking plugin on production sites until a complete patch is confirmed.
- Implement WAF rules to block unauthenticated requests to the view_request_details action.
- Reduce the sensitivity of stored booking fields by minimizing collected personal data where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
