Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization

Wordfence Intelligence   >   Vulnerability Database   >   Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.41 - Missing Authorization
5.3
Missing Authorization
CVE CVE-2026-42675
CVSS 5.3 (Medium)
Publicly Published May 15, 2026
Last Updated May 19, 2026
Researcher Raihan Adi Arba

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.41. This makes it possible for unauthenticated attackers to perform an unauthorized action.

References

Share

Vulnerability Details for Hydra Booking — Appointment Scheduling & Booking Calendar

Hydra Booking — Appointment Scheduling & Booking Calendar

Software Type Plugin
Software Slug hydra-booking (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.1.42, or a newer patched version
Affected Version
  • <= 1.1.41
Patched Version
  • 1.1.42

Recent vulnerabilities in Hydra Booking — Appointment Scheduling & Booking Calendar

Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
6.4
CVE-2026-15948
Aug 14, 2026
Researcher: Wordfence PRISM
Hydra Booking <= 1.2.2 - Missing Authorization
5.3
CVE-2026-28188
Aug 13, 2026
Researcher: Dave Jong
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
4.3
CVE-2026-12433
Jul 8, 2026
Researcher: Quang
Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-57388
Jul 8, 2026
Researcher: Nguyen Dinh Hai (HaiND)
Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting
6.4
CVE-2026-39541
Feb 15, 2026
Researcher: benzdeus
Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation
9.8
CVE-2025-68027
Jan 21, 2026
Researcher: daroo
Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection
6.5
CVE-2025-68055
Nov 27, 2025
Researcher: Jarno Vos (jarnovos)
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
5.3
CVE-2025-12788
Nov 10, 2025
Researcher: Ahmad Salem (a7mad.cc)
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
5.3
CVE-2025-12787
Nov 10, 2025
Researcher: Ahmad Salem (a7mad.cc)
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
8.8
CVE-2025-7689
Jul 28, 2025
Researcher: kr0d
# Title CVE ID CVSS Researchers Date
1 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-15948 6.4 Wordfence PRISM August 14, 2026
2 Hydra Booking <= 1.2.2 - Missing Authorization CVE-2026-28188 5.3 Dave Jong August 13, 2026
3 Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter CVE-2026-12433 4.3 Quang July 8, 2026
4 Hydra Booking — Appointment Scheduling & Booking Calendar <= 1.1.44 - Unauthenticated Stored Cross-Site Scripting CVE-2026-57388 7.2 Nguyen Dinh Hai (HaiND) July 8, 2026
5 Hydra Booking <= 1.1.38 - Authenticated (Hydra host+) Stored Cross-Site Scripting CVE-2026-39541 6.4 benzdeus February 15, 2026
6 Hydra Booking <= 1.1.32 - Unauthenticated Privilege Escalation CVE-2025-68027 9.8 daroo January 21, 2026
7 Hydra Booking <= 1.1.32 - Authenticated (Custom role+) SQL Injection CVE-2025-68055 6.5 Jarno Vos (jarnovos) November 27, 2025
8 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass CVE-2025-12788 5.3 Ahmad Salem (a7mad.cc) November 10, 2025
9 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation CVE-2025-12787 5.3 Ahmad Salem (a7mad.cc) November 10, 2025
10 Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function CVE-2025-7689 8.8 kr0d July 28, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation