CVE-2026-92420

LOWCVSS 3.8

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

Timeline

Published:September 19th, 2026 7:16 AM

Last modified:September 21st, 2026 1:34 PM

CVSS Scoring

CVSS v3: 3.8 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/3685e160-f3a4-4772-b2e3-f6155894ab4c/

Source: NIST NVD · Data may lag official sources by up to one minute