Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-19T07:16:34.000Z",
  "pubdate": "2026-09-19T07:16:34.000Z",
  "executiveSummary": "The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress, specifically versions prior to 1.2.3, contains an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw allows authenticated users who possess a 'host' role to manipulate profile data belonging to other registered hosts within the system. By failing to perform proper server-side authorization checks on the target resource, the application permits an attacker to perform unauthorized modifications to sensitive booking profiles. Furthermore, the vulnerability facilitates a privilege escalation vector through account takeover, as an attacker can reassign the ownership of another host's record to their own account. This compromise can lead to unauthorized access to booking data, potential sensitive information disclosure, and full operational disruption of the affected host's scheduling services. Successful exploitation requires a valid user account with 'host' level privileges and does not require elevated administrative access, making it a significant risk to data integrity and multi-tenant isolation within the WordPress environment.",
  "technicalDetails": "The vulnerability resides within the backend processing logic responsible for handling host record modifications in the Hydra Booking — Appointment Scheduling & Booking Calendar plugin. The root cause of this issue is an authorization bypass resulting from a lack of server-side validation regarding object ownership. Specifically, the application fails to verify whether the requester, identified by their session, holds legitimate ownership or authorized access to the specific host record being requested for update.\nDuring the standard operation of the plugin, when a host initiates a request to update their profile information—such as contact details, booking availability, or administrative settings—the application processes the input through a controller or API endpoint. Because the application logic does not cross-reference the unique identifier of the host record (the object) against the authenticated user's ID (the subject) prior to executing the database update operation, the system becomes susceptible to IDOR exploitation.\nAn attacker can exploit this by intercepting the legitimate request intended for their own profile and modifying the identifier parameter in the request payload to target a victim's host record ID. Since the application trustfully executes the provided SQL query or data update function without verifying authorization, the changes submitted by the attacker are applied to the victim's profile. This mechanism allows the attacker to alter arbitrary host data and, crucially, manipulate ownership fields.\nBy modifying the ownership association, the attacker can effectively reassign a target host's booking record to their own user account. This provides the attacker with total control over the victim's scheduling dashboard, allowing them to intercept incoming bookings, modify pricing or availability, and access sensitive client information associated with that specific host account.\nThis vulnerability is restricted to authenticated sessions under the 'host' role and is not exploitable by unauthenticated visitors. However, because the WordPress environment typically allows for self-registration or assignment of such roles, the attack surface remains high for any platform utilizing this plugin to manage multiple vendor profiles. There are no known client-side input sanitization issues reported; rather, the fault lies entirely within the server-side access control implementation."
}