CVE-2026-92421: Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR

Q: Which users can exploit this issue?

Exploitation requires authentication and a host role assigned by the Hydra Booking plugin. Users without that plugin-assigned host role are not identified as able to exploit the issue.

Q: What access does a successful attacker gain?

An eligible attacker can modify another host's profile data and change ownership of that host record to themselves. This can result in takeover of another host profile.

Q: Which versions are affected?

Hydra Booking versions before 1.2.3 are affected. Version 1.2.3 is not identified as affected in the provided information.

Published Sep 19, 2026

Updated

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

Affected Software

1 affected component

WordPress Hydra Booking — Appointment Scheduling & Booking Calendar<1.2.3

Event History

Sep 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Exploitation requires authentication and a host role assigned by the Hydra Booking plugin. Users without that plugin-assigned host role are not identified as able to exploit the issue.

What access does a successful attacker gain?

An eligible attacker can modify another host's profile data and change ownership of that host record to themselves. This can result in takeover of another host profile.

Which versions are affected?

Hydra Booking versions before 1.2.3 are affected. Version 1.2.3 is not identified as affected in the provided information.