The Hydra Booking plugin contains a weakness corresponding to CWE‑330, where the token used to cancel a booking is generated from insufficiently random values and shared across all users. This flaw allows an attacker who is not logged in to guess or brute force a valid token and trick the system into canceling an existing booking without authorization. The direct consequence is loss of service and potential business disruption if critical appointments are canceled.

WordPress sites that have the Hydra Booking plugin at version 1.1.27 or earlier. The vulnerability applies to all installations regardless of other plugins or themes because the flaw is inherent to the plugin's core cancellation logic.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of automated exploitation. The flaw is not listed in CISA's KEV catalog, pointing to limited known exploitation. Attackers would need to repeatedly attempt to guess the cancellation token via the public AJAX endpoint, which may take a significant amount of time given the token weak randomness. Despite this, once a valid token is discovered the attacker can cancel any booking belonging to any user.