CVE-2026-92425 in Hydra Booking Plugin
Summary
by MITRE • 09/19/2026
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.4 represents a critical failure in server-side access control mechanisms within a widely used WordPress ecosystem plugin. This flaw is classified under CWE-862, which denotes Missing Authorization, and specifically manifests as an Insecure Direct Object Reference (CWE-200) scenario where the application fails to verify that the authenticated user has permission to perform actions on specific data objects. The core technical issue lies in the absence of object-level authorization checks during host-management operations. While the plugin correctly restricts access based on high-level roles such as Administrator, it neglects to validate ownership or permissions when executing CRUD (Create, Read, Update, Delete) functions against individual host records. Consequently, any user assigned a custom role by an administrator can interact with API endpoints or administrative pages that handle host data without the system verifying whether those actions are authorized for that specific user context relative to the target resource.
From an operational perspective, this vulnerability allows malicious actors who have obtained low-privilege access within the WordPress environment to escalate their impact significantly. By exploiting the lack of object-level checks, these users can enumerate and retrieve sensitive information belonging to other hosts, including personal details and appointment schedules. More critically, they possess the ability to modify existing records or permanently delete host accounts. Since these host records are often linked directly to specific WordPress user accounts, the deletion of a host record effectively results in the destruction of associated user data, leading to irreversible loss of information for legitimate business operators. This capability disrupts service availability and integrity, potentially causing significant financial and reputational damage to businesses relying on the plugin for appointment management.
The attack vector aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it requires initial authentication but leverages improper access control rather than credential theft or privilege escalation through system vulnerabilities. It also relates to T1496, Resource Hijacking, in the context of disrupting business operations by deleting critical data assets. The severity is heightened because WordPress plugins often run with elevated privileges relative to standard web applications, and a flaw here can compromise the entire site's database integrity if not contained properly.
Mitigation for this vulnerability requires immediate action from both plugin developers and site administrators. Developers must implement strict object-level authorization checks in all host-management endpoints, ensuring that every request verifies the requesting user’s relationship to the target resource before processing any modifications or deletions. This involves validating ownership IDs against session data or database queries at the code level for each operation. For existing installations running versions earlier than 1.2.4, the recommended course of action is to update the plugin immediately upon release of version 1.2.4 which addresses these access control gaps. In environments where updating is not immediately feasible, administrators should restrict custom roles with host-management capabilities to only trusted users and monitor logs for unusual deletion or modification patterns until the patch can be applied.