CVE-2026-12433 json
Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
published 2026-07-09 4 mo ago modified 2026-07-09 4 mo ago also EUVD-2026-42550
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- themefic Hydra Booking — Appointment Scheduling & Booking Calendar
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/aa00fe53-dc65-4200-80bb-9167b4230194?source=cve
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.44/admin/Controller/BookingController.php#L1418
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.44/admin/Controller/BookingController.php#L100
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.44/admin/Controller/RouteController.php#L55
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.44/includes/hooks/ActivationHooks.php#L38
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.41/admin/Controller/BookingController.php#L1418
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.41/admin/Controller/BookingController.php#L100
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.41/admin/Controller/RouteController.php#L55
- plugins.trac.wordpress.org /browser/hydra-booking/tags/1.1.41/includes/hooks/ActivationHooks.php#L38
- plugins.trac.wordpress.org /changeset?reponame=&old=3600170%40hydra-booking&new=3600170%40hydra-booking
Sources
- CVE List CVE-2026-12433
- NVD CVE-2026-12433
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.