Hydra Booking CVE-2026-28188

No authentication, no special privileges, and no user interaction are required - fully consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. The sole prerequisite is that the target WordPress site has the Hydra Booking plugin installed, activated, and running version 1.2.2 or earlier; no non-default configuration is necessary. Exploitation is limited in scope by the unchanged scope (S:U): impact is confined to the booking plugin's data and registered actions and does not inherently grant broader WordPress administrative access, database root privileges, or server-level code execution. The primary limiting factor is the bounded impact - an attacker gains leverage over booking records, not the underlying system.

The CVSS score of 7.3 (High) is primarily driven by the network-accessible, zero-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), though the Low ratings across all three impact dimensions (C:L/I:L/A:L) signal that a successful exploit yields bounded harm - unauthorized access to booking records rather than full site or server compromise. EPSS data is absent from available intelligence, so a numerical exploitation probability cannot be cited; however, the trivially low attack complexity means automated WordPress scanning tools could reliably trigger this flaw across many sites simultaneously, raising portfolio risk for managed hosting providers or large plugin estates. No CISA KEV listing exists and no public exploit code has been identified, which reduces immediacy compared to actively exploited issues - even a mid-sized municipal IT team in inowroclaw should treat this as urgent given the entirely unauthenticated network vector, while recognizing the impact ceiling is constrained to booking data. The greatest realistic risk is unauthorized manipulation or exfiltration of appointee information rather than privilege escalation or remote code execution.

An unauthenticated attacker identifies a WordPress site running Hydra Booking ≤ 1.2.2 - discoverable via plugin fingerprinting or mass scanning - and sends crafted HTTP POST requests to the plugin's unprotected AJAX or REST endpoints without any session or credential. Because the authorization check is absent, the server processes the request as if it were a legitimate privileged action, allowing the attacker to enumerate, exfiltrate, or tamper with booking records. No public exploit code has been identified, but the AC:L/PR:N profile means this is replicable with basic HTTP tooling and minimal WordPress knowledge.