Hydra Booking Appointment Scheduling Booking Calendar
Monthly
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 let any user holding the plugin's administrator-assigned host-management custom role read, modify, and permanently delete other hosts' records along with the linked WordPress user accounts. The flaw is remotely reachable with low complexity (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, 5.5) but is gated behind a role that a WordPress administrator must first provision, making this an insider or delegated-privilege abuse scenario rather than an unauthenticated attack; publicly available exploit code exists (WPScan disclosure), though no confirmed active exploitation (CISA KEV) has been reported. The integrity impact is the dominant concern because deletions are irreversible and extend to WordPress user accounts, not just plugin data.
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. The issue is a horizontal privilege-abuse/IDOR flaw rated CVSS 4.7 (MEDIUM) under the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - the attacker must already possess host-level access and gains only limited, cross-host read/write capability, not administrative or site-wide control.
Authenticated users holding the plugin's booking-provider role on WordPress sites running Hydra Booking - Appointment Scheduling & Booking Calendar before 1.2.2 can cancel and permanently delete bookings belonging to other providers, because two booking endpoints act on a supplied booking identifier without confirming that the booking belongs to the requesting user. The issue is a classic insecure direct object reference (CWE-639) and is only meaningful on installations that host multiple providers, so single-provider sites gain no adversarial advantage. Publicly available exploit code exists, but no active exploitation has been confirmed (no CISA KEV listing), and the practical risk remains low: the attacker must already hold a legitimate provider account and the outcome is limited to integrity (cancel/modify) and availability (deletion) impact on booking records, with no confidentiality exposure.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
Confidential booking data disclosure in Hydra Booking 1.2.1 and earlier for WordPress allows authenticated Host-level attackers to view other hosts' booking details by iterating booking IDs at the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. No public exploit or active exploitation has been reported; EPSS exploitation probability is very low (0.43%).
Object-level authorization failures in the Hydra Booking - Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 let any user holding the plugin's administrator-assigned host-management custom role read, modify, and permanently delete other hosts' records along with the linked WordPress user accounts. The flaw is remotely reachable with low complexity (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, 5.5) but is gated behind a role that a WordPress administrator must first provision, making this an insider or delegated-privilege abuse scenario rather than an unauthenticated attack; publicly available exploit code exists (WPScan disclosure), though no confirmed active exploitation (CISA KEV) has been reported. The integrity impact is the dominant concern because deletions are irreversible and extend to WordPress user accounts, not just plugin data.
Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. The issue is a horizontal privilege-abuse/IDOR flaw rated CVSS 4.7 (MEDIUM) under the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - the attacker must already possess host-level access and gains only limited, cross-host read/write capability, not administrative or site-wide control.
Authenticated users holding the plugin's booking-provider role on WordPress sites running Hydra Booking - Appointment Scheduling & Booking Calendar before 1.2.2 can cancel and permanently delete bookings belonging to other providers, because two booking endpoints act on a supplied booking identifier without confirming that the booking belongs to the requesting user. The issue is a classic insecure direct object reference (CWE-639) and is only meaningful on installations that host multiple providers, so single-provider sites gain no adversarial advantage. Publicly available exploit code exists, but no active exploitation has been confirmed (no CISA KEV listing), and the practical risk remains low: the attacker must already hold a legitimate provider account and the outcome is limited to integrity (cancel/modify) and availability (deletion) impact on booking records, with no confidentiality exposure.
Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.
Confidential booking data disclosure in Hydra Booking 1.2.1 and earlier for WordPress allows authenticated Host-level attackers to view other hosts' booking details by iterating booking IDs at the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. No public exploit or active exploitation has been reported; EPSS exploitation probability is very low (0.43%).