Hydra Booking — Appointment Scheduling & Booking Calendar

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Hydra Booking — Appointment Scheduling & Booking Calendar

Information

Software Type Plugin
Software Slug hydra-booking (view on wordpress.org)
Software Status Active
Software Author themefic
Software Website hydrabooking.com
Software Downloads 50,553
Software Active Installs 2,000
Software Record Last Updated August 13, 2026

12 Vulnerabilities

Submit a Vulnerability
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
4.3
CVE-2026-12433
Jul 8, 2026
Researcher: Quang
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57388
Jul 8, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
5.3
CVE-2026-42675
May 15, 2026
Researcher: Raihan Adi Arba
Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting
6.4
CVE-2026-39541
Feb 15, 2026
Researcher: benzdeus
Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation
9.8
CVE-2025-68027
Jan 21, 2026
Researcher: daroo
Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection
6.5
CVE-2025-68055
Nov 27, 2025
Researcher: Jarno Vos (jarnovos)
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
5.3
CVE-2025-12788
Nov 10, 2025
Researcher: Ahmad Salem (a7mad.cc)
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
5.3
CVE-2025-12787
Nov 10, 2025
Researcher: Ahmad Salem (a7mad.cc)
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
8.8
CVE-2025-7689
Jul 28, 2025
Researcher: kr0d
Hydra Booking <= 1.1.10 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-49378
Jun 12, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
Hydra Booking <= 1.1.9 - Missing Authorization
4.3
CVE-2025-49377
Jun 12, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
Hydra Booking <= 1.1.10 - Authenticated (Contributor+) SQL Injection
6.5
CVE-2025-49323
Jun 5, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
Title Status CVE ID CVSS Researchers Date
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter Patched CVE-2026-12433 4.3 Quang July 8, 2026
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-57388 7.2 Nguyen Dinh Hai (HaiND) July 8, 2026
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization Patched CVE-2026-42675 5.3 Raihan Adi Arba May 15, 2026
Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting Patched CVE-2026-39541 6.4 benzdeus February 15, 2026
Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation Patched CVE-2025-68027 9.8 daroo January 21, 2026
Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection Patched CVE-2025-68055 6.5 Jarno Vos (jarnovos) November 27, 2025
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass Patched CVE-2025-12788 5.3 Ahmad Salem (a7mad.cc) November 10, 2025
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation Patched CVE-2025-12787 5.3 Ahmad Salem (a7mad.cc) November 10, 2025
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function Patched CVE-2025-7689 8.8 kr0d July 28, 2025
Hydra Booking <= 1.1.10 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-49378 6.5 Nguyen Ngoc Quang Bach (maysbachs) June 12, 2025
Hydra Booking <= 1.1.9 - Missing Authorization Patched CVE-2025-49377 4.3 Nguyen Ngoc Quang Bach (maysbachs) June 12, 2025
Hydra Booking <= 1.1.10 - Authenticated (Contributor+) SQL Injection Patched CVE-2025-49323 6.5 Nguyen Ngoc Quang Bach (maysbachs) June 5, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation