CVE-2026-92421 in Hydra Booking Plugin
Summary
by MITRE • 09/19/2026
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in versions of the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin prior to version 1.2.3 represents a critical failure in server-side access control mechanisms, specifically manifesting as an Insecure Direct Object Reference (IDOR). This flaw arises from the application's inability to properly validate whether the resource being modified via HTTP requests actually belongs to the authenticated user initiating those requests. The plugin manages host records for appointment scheduling, and while it enforces authentication by requiring users to hold a specific Hydra Booking-assigned host role, it fails to implement robust authorization checks on the backend logic that processes profile updates or ownership transfers. Consequently, an attacker who has obtained valid credentials with this limited host privilege can manipulate API endpoints or form submissions to target arbitrary record identifiers associated with other hosts within the system.
From a technical perspective, the core issue lies in the lack of object-level permission verification during state-changing operations. When a user attempts to modify their profile data or reassign ownership of a host record, the application accepts the provided identifier for the target resource without cross-referencing it against the identity and permissions of the authenticated session. This allows an attacker to simply alter parameters in network requests to point to different host IDs. By doing so, they can overwrite sensitive personal information belonging to other hosts or execute logic that transfers administrative ownership of another user's scheduling infrastructure to their own account. This bypasses the intended security boundary where each host should only have authority over their own data and settings.
The operational impact of this vulnerability is significant for both individual users and organizations relying on the plugin for business operations. An attacker can compromise the integrity of other hosts' profiles by injecting malicious content, altering contact details to facilitate phishing attacks against clients, or disrupting service availability by misconfiguring scheduling parameters. More severely, the ability to reassign ownership means an attacker can take full control over another host's appointment calendar and associated data. This could lead to unauthorized access to customer information stored within those appointments, potential financial fraud if payment integrations are linked to these hosts, and a complete loss of trust in the platform's reliability. The breach extends beyond simple data leakage into active manipulation of business-critical workflows managed by the plugin.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures where access control decisions do not properly enforce intended restrictions on authorized actors accessing specific objects or resources. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as exploitation requires legitimate credentials, and potentially T1531, Account Access Removal, if the attacker uses ownership reassignment to lock out the original owner from their own account. To mitigate this risk, administrators must immediately upgrade the Hydra Booking plugin to version 1.2.3 or later, where these authorization checks have been implemented. Until an update is applied, it is advisable to restrict access to the WordPress admin area and any exposed endpoints associated with the plugin using web application firewall rules that monitor for anomalous parameter manipulation patterns indicative of IDOR attacks.