EUVD-2026-42550
GHSA-v72c-9vq7-w8x4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST API (AV:N), requires Hydra Host authentication (PR:L), no interaction needed; only booking record confidentiality is impacted (C:L), with no integrity or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Hydra Booking - Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.
AnalysisAI
{id} enforces only the tfhb_manage_options capability check but never validates that the requested booking ID is owned by the requesting host, exposing attendee PII (names, emails, phone numbers, addresses), payment method and status, transaction history, and internal notes. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a fix commit is present in the WordPress plugin SVN repository.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold an authenticated WordPress account assigned the Hydra Host role or any higher-privileged role - this role is created automatically by the plugin on activation and grants the tfhb_manage_options capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is technically appropriate but may understate business risk in multi-tenant deployments where the plugin hosts many independent booking hosts, as the confidentiality impact encompasses structured PII and financial transaction data across all tenants. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or has compromised a Hydra Host account on a multi-host WordPress booking site sends sequential authenticated GET requests to /wp-json/hydra-booking/v1/booking/details/1, /2, /3, and so on using their valid session credentials. Because the endpoint verifies only the tfhb_manage_options capability and not booking ownership, each request returns the complete booking record regardless of which host owns it, enabling a full harvest of all tenants' attendee PII, payment status, and internal notes. … |
| Remediation | The primary remediation is to update the Hydra Booking plugin to a version beyond 1.2.1; a fix commit is available in the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3600170%40hydra-booking&new=3600170%40hydra-booking), though the exact patched release version number is not confirmed in available data - verify the current version in the WordPress.org plugin directory before updating and confirm the changelog references this fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today