WordPress Plugin Vulnerabilities

Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

Description

The plugin does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

Proof of Concept

Affects Plugins

Plugin icon
hydra-booking
Fixed in 1.2.2

References

CVE
CVE-2026-92420

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
3685e160-f3a4-4772-b2e3-f6155894ab4c

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2024-06-06
Title
Tutor LMS – eLearning and online course solution < 2.7.2 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
Published
2023-09-12
Title
Simplr Registration Form Plus+ <= 2.4.5 - Subscriber+ Arbitrary User Password Change via IDOR
Published
2026-07-31
Title
WooCommerce PayPal Payments < 3.4.0 - Unauthenticated Order Key and Customer PII Disclosure via IDOR
Published
2026-08-03
Title
MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR
Published
2023-12-05
Title
WP Photo Album Plus < 8.6.01.003 - Insecure Direct Object Reference