Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-12433: Hydra Booking plugin for WordPress allows unauthorized access to booking records

CVE-2026-12433 · published 3 months ago

Summary

The Hydra Booking plugin for WordPress, versions up to 1.2.1, allows authenticated users with certain permissions to view sensitive information about bookings made by other users. This could lead to unauthorized access to private details such as names, emails, and meeting information. To fix this, update the plugin to version 1.2.2 or later.

Original advisory text

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published9 Jul 2026

Updated4 Nov 2026

First seen9 Jul 2026

Sources

CVE-2026-12433 · NVD

Track software like this

Free during beta