eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
Priority MEDIUM 63CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
Why it matters now
EPSS 0.24635 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC (Unknown): 1.1.16
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC | 1.1.16 to before 1.1.16 | 1.1.16 | Patch available | CNA |
- Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC VendorUnknown Affected 1.1.16 to before 1.1.16 Fixed in 1.1.16 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:* | before 1.1.16 | Vulnerable | Syntacticsinc |
- cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:* Versions before 1.1.16 Vulnerable ·Syntacticsinc
Remediation
- Fix · CNA Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC (Unknown) Fixed in 1.1.16
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1952
- 2026-10-03 Alias added: GHSA-cq3m-ccp4-jccg
References
More Syntacticsinc Easync vulnerabilities
- TI-2024-08769 Cross-site request forgery in Free Booking Plugin for Hotels, Restaurants and Car Rentals CVSS 3.1MEDIUM 6.5
- TI-2023-19768 WordPress eaSYNC Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
- TI-2025-04189 Authorization bypass in Syntactics, Inc. eaSYNC Booking – Hotels, Restaurants & Car… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2022-1952 · CVE Program
- CVE-2022-1952 · NVD
- FIRST EPSS
- GHSA-cq3m-ccp4-jccg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences