Cross-site request forgery in Free Booking Plugin for Hotels, Restaurants and Car Rentals
Priority MEDIUM 62CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-352.
Summary
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Free Booking Plugin for Hotels, Restaurants and Car Rentals (Unknown): 1.3.15
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Free Booking Plugin for Hotels, Restaurants and Car Rentals | before 1.3.15 | 1.3.15 | Patch available | CNA |
- Free Booking Plugin for Hotels, Restaurants and Car Rentals VendorUnknown Affected before 1.3.15 Fixed in 1.3.15 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:* | before 1.3.15 | Vulnerable | Syntacticsinc |
- cpe:2.3:a:syntacticsinc:easync:*:*:*:*:*:wordpress:*:* Versions before 1.3.15 Vulnerable ·Syntacticsinc
Remediation
- Fix · CNA Free Booking Plugin for Hotels, Restaurants and Car Rentals (Unknown) Fixed in 1.3.15
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9450
- 2026-10-03 Alias added: GHSA-vgrm-7j7m-pjmg
References
More Syntacticsinc Easync vulnerabilities
- TI-2022-01811 eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2023-19768 WordPress eaSYNC Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
- TI-2025-04189 Authorization bypass in Syntactics, Inc. eaSYNC Booking – Hotels, Restaurants & Car… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-9450 · CVE Program
- CVE-2024-9450 · NVD
- FIRST EPSS
- GHSA-vgrm-7j7m-pjmg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences