CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
MEDIUM 4.7EPSS 0.3%
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
- Affected
- Hydra Booking — Appointment Scheduling & Booking Calendar
- CVSS v3.1 CNA
- 4.7 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - EPSS
- 0.29% chance of exploitation in the next 30 days, 20th percentile
- Published
- 2026-09-19