Hydra Booking CVE-2026-42675

Exploitation requires the target WordPress site to have the Themefic Hydra Booking plugin installed and active at version 1.1.41 or earlier, with the affected plugin endpoints reachable over the network - which is the default for any public WordPress site since admin-ajax.php and the REST API are exposed by default. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or non-default configuration is needed, so any internet-facing WordPress installation running the vulnerable plugin version is exposed. The limiting factor is the C:L/I:L/A:L impact scope: the missing authorization affects specific booking-related functions rather than granting full administrative control, so the attacker's actions are constrained to what those particular unprotected endpoints expose.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates trivial network-based exploitation with no authentication or user interaction, which is the highest-risk profile from an accessibility standpoint, but the C:L/I:L/A:L impact metrics cap the score at 7.3 (High) rather than Critical because individual operations leak or modify limited data rather than yielding full takeover. EPSS data was not provided in the input, KEV status is not listed, and no POC reference was supplied - so despite the easy attack vector, real-world exploitation pressure appears moderate rather than urgent. The Patchstack advisory is the sole confirming source, and the lack of independent NVD enrichment or exploit telemetry means defenders should treat this as a patch-soon issue for any internet-exposed WordPress instance running the plugin, but not a drop-everything emergency absent evidence of mass scanning.

An unauthenticated remote attacker identifies a WordPress site running Hydra Booking 1.1.41 or earlier through plugin fingerprinting, then issues a direct HTTP request to a plugin REST or AJAX endpoint that lacks proper authorization checks. The attacker invokes booking-management functions reserved for site administrators or booking staff, allowing them to read, modify, or delete booking records belonging to other users without ever logging in. No public POC has been released, so practical exploitation requires the attacker to reverse-engineer the specific vulnerable endpoint from the patched code diff.