Hydra Booking hosts misuse of a REST endpoint allows an authenticated user with host‑level permissions to retrieve booking details for any booking ID. The getBookingDetails() callback only checks that the caller has the tfhb_manage_options capability, but does not verify that the booking belongs to the same host account making the request. As a result, an attacker can iterate booking identifiers and disclose attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes. This flaw is a classic Insecure Direct Object Reference (CWE‑639) that compromises confidentiality but does not enable code execution or denial of service.

All WordPress installations that have installed Hydra Booking version 1.2.1 or earlier. Any site that creates the plugin’s host role or assigns the tfhb_manage_options capability to authenticated users is susceptible, because those users can hit the unsecured /wp-json/hydra-booking/v1/booking/details/{id} endpoint.

The CVSS v3 score of 4.3 indicates a moderate confidentiality impact but no impact on integrity or availability. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog, meaning no active public exploits are known. The vulnerability requires an attacker to be logged in with sufficient host‑level privileges, so the attack surface is limited to sites that grant those permissions. Nonetheless, compromised host credentials or social engineering could allow an attacker to fetch sensitive booking data from other hosts.