WordPress Plugin Vulnerabilities

Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

Description

The plugin does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a plugin-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

Proof of Concept

Affects Plugins

Plugin icon
hydra-booking
Fixed in 1.2.3

References

CVE
CVE-2026-92421

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
Ossacip Thanh
Submitter
Ossacip Thanh
Submitter website
https://vncsglobal.vn/
Verified
Yes
WPVDB ID
3ba305b9-5f3b-47eb-a5d7-ddbeeeefd0a4

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2026-07-08
Title
Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
Published
2021-03-17
Title
BuddyPress < 7.2.1 - Manage BuddyPress Member Types
Published
2021-03-31
Title
Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
Published
2026-04-06
Title
Amelia < 2.2 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter
Published
2023-07-26
Title
ACF Photo Gallery Field < 2.0 - Subscriber+ UserMeta Update