WordPress Plugin Vulnerabilities

Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR

Description

The plugin does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

Proof of Concept

Affects Plugins

Plugin icon
hydra-booking
Fixed in 1.2.4

References

CVE
CVE-2026-92425

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Stefan Spasic
Submitter
Stefan Spasic
Verified
Yes
WPVDB ID
b6d64e8f-e52a-4286-bd78-15f7a31d876f

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-17 (about 1 day ago)

Other

Published
Title
Published
2026-05-01
Title
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible < 6.7.26 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion
Published
2026-09-14
Title
Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR
Published
2026-01-15
Title
Shield Security < 21.0.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
Published
2025-03-14
Title
School Management System – WPSchoolPress < 2.2.17 - Teacher+ Privilege Escalation
Published
2026-06-10
Title
VikRentCar Car Rental Management System < 1.4.6 - Unauthenticated Insecure Direct Object Reference