EUVD-2026-83514
GHSA-pw3m-2xrj-4fq6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Host is a business role not an admin, so PR:L not PR:H; profile overwrite/ownership reassignment is C:L/I:L, and ownership change is integrity rather than availability, so A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
AnalysisAI
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account that holds the plugin's assigned 'host' role on a Hydra Booking (Appointment Scheduling & Booking Calendar) site running a version between 1.1.0 and before 1.2.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority authorization flaw (IDOR, CWE-639) rated CVSS 4.7 (MEDIUM). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Hydra Booking - Appointment Scheduling & Booking Calendar to version 1.2.3 or later, which adds the missing ownership verification on the host-record modification endpoint; this is the only complete fix and should be applied to every site where the plugin is enabled. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin be
Authenticated users holding the plugin's booking-provider role on WordPress sites running Hydra Booking - Appointment Sc
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary w
Confidential booking data disclosure in Hydra Booking 1.2.1 and earlier for WordPress allows authenticated Host-level at
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today