EUVD-2025-17249
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking allows SQL Injection. This issue affects Hydra Booking: from n/a through 1.1.10.
AnalysisAI
SQL injection vulnerability in Themefic Hydra Booking plugin versions through 1.1.10 that allows authenticated attackers to execute arbitrary SQL queries. An attacker with user-level privileges can manipulate SQL commands to extract sensitive database information, bypass authentication, or modify data without user interaction. This vulnerability has a CVSS score of 8.5 (High) and represents a significant risk to WordPress installations using affected versions of the plugin.
Technical ContextAI
The vulnerability exists in the Hydra Booking WordPress plugin, a booking management solution. The root cause is improper neutralization of special SQL characters (CWE-89: SQL Injection), indicating that user-supplied input is concatenated directly into SQL queries without proper parameterization or prepared statements. The affected component likely processes booking-related data, search filters, or administrative functions that construct database queries. The plugin is distributed through WordPress.org plugin repository (CPE would be cpe:2.3:a:themefic:hydra-booking:*:*:*:*:*:wordpress:*:*). The vulnerability requires an authenticated user (PR:L in CVSS vector), meaning either a legitimate user account or compromised credentials are needed as an initial foothold.
RemediationAI
Navigate to WordPress Admin Dashboard > Plugins > Hydra Booking > Update to latest version Mitigation (if patch unavailable): WordPress Admin > Plugins > Deactivate Hydra Booking Detection: Review wp-content/debug.log and database error logs for SQL errors containing booking-related queries Access Control: WordPress Admin > Users > Review and remove excessive permissions
Share
External POC / Exploit Code
Leaving vuln.today