What is the CVSS score of CVE-2026-28188?

CVE-2026-28188 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Hydra Booking are affected by CVE-2026-28188?

The Hydra Booking WordPress plugin (versions ≤ 1.2.2) contains an unauthenticated access control vulnerability that exposes booking data to unauthorized modification, deletion, or disclosure by any…

How to fix or mitigate CVE-2026-28188?

Within 24 hours, immediately disable the Hydra Booking plugin or restrict all access to its endpoints via Web Application Firewall rules that limit booking functionality to known administrative IP ranges only. Within 7 days, contact Themefic to confirm patch availability and timeline; simultaneously, identify and evaluate alternative WordPress booking plugins for migration. Within 30 days, deploy a vendor patch when released, migrate to a patched alternative solution, or implement permanent compensating controls including IP allowlisting, reverse proxy authentication enforcement, and audit logging of all booking data access.

Hydra Booking CVE-2026-28188

EUVD-2026-57966 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-xgq6-462m-h462

WordPress Authentication Bypass Hydra Booking Wordpress Plugin Themefic

7.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-accessible with zero prerequisites per unauthenticated design; Low C/I/A because impact is scoped to plugin booking data with no scope change to broader system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:50 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.3

DescriptionCVE.org

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

AnalysisAI

Unauthenticated broken access control in the Hydra Booking WordPress plugin by Themefic (versions ≤ 1.2.2) permits any remote, unauthenticated party to bypass authorization checks and interact with restricted plugin functionality. The CWE-862 root cause - missing authorization - means protected endpoints can be triggered by anonymous HTTP requests, enabling unauthorized reading, modification, or disruption of booking data. No public exploit code and no active exploitation have been confirmed at the time of analysis.

Technical ContextAI

Hydra Booking is a WordPress appointment and scheduling plugin developed by Themefic, identified by CPE cpe:2.3:a:themefic:hydra_booking:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-862 (Missing Authorization), a root cause where the application registers actions or routes - typically WordPress AJAX handlers or REST API endpoints - without enforcing capability checks such as current_user_can() before executing sensitive operations. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over the network with no prerequisites, while S:U (Unchanged scope) indicates impact is contained within the plugin's own booking data and does not inherently propagate to the broader WordPress core or host operating system.

RemediationAI

Update the Hydra Booking plugin to the latest available version beyond 1.2.2 - check the official WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-2-2-broken-access-control-vulnerability for the confirmed fix version, as no exact patched release number is present in current data. No exact fix version is independently confirmed from available intelligence, so verify directly with Themefic before upgrading to ensure the target version contains the authorization fix. If an immediate upgrade is not feasible, temporarily deactivating the Hydra Booking plugin removes the attack surface entirely at the cost of all booking functionality. As a partial compensating control, a web application firewall rule targeting the plugin's specific AJAX action names or REST API route prefixes may reduce exposure, though effectiveness depends on which endpoints are vulnerable and may break legitimate booking workflows - test in staging before deploying.