Hydra Booking < 1.1.28 - Unauthenticated Payment Bypass

Description

The plugin is vulnerable to missing payment verification to unauthenticated payment bypass due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.