CVE-2026-42675
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Missing Authorization vulnerability in Themefic Hydra Booking up to version 1.1.41. It allows exploiting incorrectly configured access control security levels.
Risk Assessment
An attacker can gain unauthorized access to booking functions or data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the Hydra Booking plugin to the latest version that includes the authorization fix.
Other vulnerabilities in Hydra Booking
See all- CVE-2026-15948Medium
The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.
- CVE-2026-28188High
Hydra Booking plugin versions up to 1.2.2 contain an unauthenticated Broken Access Control vulnerability. An attacker without authentication can exploit this flaw to perform unauthorized operations.
- CVE-2026-57388High
The Hydra Booking WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. This affects all versions up to and including 1.1.44.
- CVE-2026-39541Medium
The Hydra Booking plugin for WordPress is vulnerable to Stored XSS. An attacker can inject a malicious script that executes in other users' browsers.
Original NVD description (English source)
Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.