CVE-2026-12433

MediumCVSS 4.3

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

35th percentile - higher than 35% of all known CVEs

Summary

The Hydra Booking plugin for WordPress up to version 1.2.1 is vulnerable to Insecure Direct Object Reference (IDOR) in the REST endpoint /wp-json/hydra-booking/v1/booking/details/{id}. The getBookingDetails() function only checks the tfhb_manage_options capability without verifying that the requested booking belongs to the authenticated host, allowing attackers to access sensitive booking data of other hosts.

Risk Assessment

Authenticated attackers with Hydra Host-level access or higher can view sensitive booking records of other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method, transaction history, and internal notes, compromising data privacy and confidentiality.

Recommendation

Immediately update the Hydra Booking plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily restrict access to the REST endpoint for unauthorized users.

Other vulnerabilities in Hydra Booking – Appointment Scheduling & Booking Calendar

CVE-2025-12788Medium
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.

Original NVD description (English source)

The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS