Skip to content
Sign in
5.5 Medium

CVE-2026-92425 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform…

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

Affected products and versions

Product Affected versions Fixed in
Hydra Booking — Appointment Scheduling & Booking Calendar 1.2 earliest → < 1.2.4 1.2.4

Other CVEs of Hydra Booking — Appointment Scheduling & Booking Calendar

The 3 CVEs of Hydra Booking — Appointment Scheduling & Booking Calendar →
CVE-2026-92421 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the… 4.7 Medium CVE-2026-92420 The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a… 3.8 Low
Track this CVE