Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-19T07:16:34.100Z",
  "pubdate": "2026-09-19T07:16:34.100Z",
  "executiveSummary": "The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization checks. This flaw affects versions prior to 1.2.4.\nThe vulnerability allows authenticated users assigned to the plugin's custom administrative role to perform unauthorized actions on records belonging to other hosts. By manipulating object identifiers in requests, these users can read, modify, or permanently delete host records and the associated WordPress user accounts.\nThis represents a significant security risk, as it permits horizontal and vertical privilege escalation, leading to unauthorized data access and potential account takeovers within the WordPress instance. Exploitation does not require external access, only the possession of an existing, plugin-specific administrative account.\nThe impact includes the compromise of sensitive host information, loss of data integrity, and unauthorized administrative control over linked user accounts, undermining the overall security posture of the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Hydra Booking plugin to implement rigorous object-level authorization checks during host-management operations. When the plugin processes requests to read, update, or delete host records, it fails to verify whether the authenticated user currently initiating the request possesses ownership or proper permissions for the specific target object ID provided in the request parameters.\nThe vulnerability resides within the plugin's backend logic responsible for handling host-management administrative tasks. Because the application trusts the user-supplied identifiers without secondary validation against the database-defined ownership or system access control lists (ACLs), it is vulnerable to IDOR-based manipulation.\nExploitation follows a predictable attack flow. A malicious actor possessing the plugin-specific administrative custom role identifies the parameter (likely an integer-based ID) used to reference specific host records in the application's API or administrative interface. The attacker then crafts HTTP requests—such as POST or GET requests targeting the host-management endpoints—and iteratively modifies the identifier parameter to reference records belonging to other hosts.\nUpon receiving these crafted requests, the server-side code executes the requested operation—read, update, or delete—on the unauthorized target object because the server fails to perform a functional security check. Consequently, the attacker can extract private information linked to other host profiles or perform administrative deletions of data they are not authorized to manage.\nFurthermore, because the plugin links host records to specific WordPress user accounts, the ability to modify or delete these host records can have cascading effects. An attacker could potentially interfere with the WordPress account integrity associated with those hosts. This vulnerability requires the attacker to be authenticated as a user with the plugin-defined custom role, meaning the attack vector is restricted to an internal malicious actor or a compromised account with these specific, plugin-assigned privileges. The lack of authorization checks fundamentally breaks the tenant-isolation logic within the plugin, allowing for arbitrary record manipulation across the hosting platform."
}