Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-09-19T07:16:33.893Z",
  "pubdate": "2026-09-19T07:16:33.893Z",
  "executiveSummary": "The Hydra Booking WordPress plugin, in versions prior to 1.2.2, contains a critical Insecure Direct Object Reference (IDOR) vulnerability.\nThis vulnerability exists due to a lack of authorization checks on specific booking management endpoints, failing to validate whether the authenticated requester possesses the necessary permissions to access or modify a specific booking object.\nThe flaw allows any authenticated user with a 'booking-provider' role to perform unauthorized cancellation or permanent deletion of bookings belonging to other providers within the same WordPress instance.\nThe risk is categorized as high, as it facilitates unauthorized data manipulation and potential business disruption by enabling providers to sabotage the scheduling operations of their peers.\nSuccessful exploitation requires the attacker to hold a valid account with 'booking-provider' privileges on the target WordPress site. No advanced technical sophistication is required beyond manipulating HTTP requests to target arbitrary booking identifiers.",
  "technicalDetails": "The vulnerability resides within the Hydra Booking plugin's backend logic responsible for processing booking management requests. The root cause is a failure to perform server-side object-level authorization checks (Authorization Bypass).\nSpecifically, the plugin exposes two booking management endpoints that interact with the database to update or delete booking records. When a request is sent to these endpoints, the application correctly authenticates the session, ensuring the user is logged in. However, the application fails to perform a validation check to verify that the 'booking_id' passed in the request is associated with the user currently issuing the command.\nUnder normal operating conditions, a provider should only be permitted to modify their own schedule or bookings assigned to their account. Because the validation logic is omitted, the application trusts the client-supplied input parameter indiscriminately. An attacker can perform a manual inspection of the application's traffic—typically via an intercepting proxy—to identify the booking IDs belonging to other providers.\nThe attack flow follows these steps: 1) The attacker authenticates as a legitimate booking-provider. 2) The attacker intercepts an outgoing request intended to cancel or delete one of their own bookings. 3) The attacker modifies the 'booking_id' parameter within the HTTP request body or URL query string to reference an ID belonging to a target booking they do not own. 4) The server processes the request, assumes the action is authorized because the attacker is a valid 'booking-provider', and executes the SQL command to cancel or delete the target record.\nThis IDOR vulnerability affects the core functionality of the plugin, specifically the endpoints responsible for booking state transitions. Because the deletion is permanent, the impact includes unauthorized data loss and the corruption of booking history. The lack of object ownership validation effectively transforms the intended access control model into a system where any provider holds elevated permissions over the entire booking database. The vulnerability is present in all versions of the Hydra Booking plugin prior to 1.2.2."
}