EUVD-2026-83515
GHSA-j3f3-wf5x-87fm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
PR:H because a WordPress admin must assign the plugin custom role; C:L for cross-host data read, I:H for arbitrary modification and permanent deletion of records and linked accounts.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
AnalysisAI
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 let any user holding the plugin's administrator-assigned host-management custom role read, modify, and permanently delete other hosts' records along with the linked WordPress user accounts. The flaw is remotely reachable with low complexity (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, 5.5) but is gated behind a role that a WordPress administrator must first provision, making this an insider or delegated-privilege abuse scenario rather than an unauthenticated attack; publicly available exploit code exists (WPScan disclosure), though no confirmed active exploitation (CISA KEV) has been reported. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold Hydra Booking's own administrator-assigned custom role (PR:H) - a WordPress administrator must first grant this host/booking-management role, so this is an insider/privilege-abuse scenario, not remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, not top-tier, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Hydra Booking plugin to version 1.2.4 or later, which is the exact fixed version identified by the ENISA EUVD affected-version range (0 <1.2.4); details are in the WPScan advisory at https://wpscan.com/vulnerability/b6d64e8f-e52a-4286-bd78-15f7a31d876f/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and
Authenticated users holding the plugin's booking-provider role on WordPress sites running Hydra Booking - Appointment Sc
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary w
Confidential booking data disclosure in Hydra Booking 1.2.1 and earlier for WordPress allows authenticated Host-level at
Share
External POC / Exploit Code
Leaving vuln.today