CVE-2026-92421

Received Received - Intake

Insecure Host Ownership Modification in Hydra Booking WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92421

Affected Vendors & Products

Vendor	Product	Version / Range
hydra_booking	appointment_scheduling_and_booking_calendar	to 1.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Hydra Booking WordPress plugin before version 1.2.3. It allows authenticated users with a specific role to modify another user's host profile data without proper verification. Attackers can reassign ownership of a host's record to themselves, potentially gaining unauthorized control over booking data.

Impact Analysis

If you use the vulnerable plugin version, an attacker with a valid user account could take over another user's host profile. This could lead to data theft, unauthorized changes to bookings, or disruption of services. It primarily affects WordPress sites using this plugin for appointment scheduling.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to personal data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. Unauthorized modifications could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin to version 1.2.3 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-92421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70