The Hydra Booking plugin has a missing authorization flaw that allows attackers to bypass the intended access control restrictions. This can result in unauthorized users being able to view, modify or delete booking data, potentially compromising customer information and undermining business operations. The weakness is identified as CWE‑862 – Missing Authorization.

The Vulnerability affects the Themefic Hydra Booking plugin on WordPress installations. All versions up to and including 1.1.41 are impacted. The problem is present from the earliest available release through 1.1.41; any deployment of those versions on a WordPress site is at risk.

The CVSS score of 7.3 indicates a high impact and the EPSS score is not available, so the exploitation probability is unknown. The flaw does not appear to require elevated privileges; attackers can leverage web requests to the plugin’s exposed endpoints to evade access checks. The plugin is not listed in CISA KEV, but the lack of a public exploit does not preclude future exploitation. Administrators should anticipate that attackers could use the web interface to manipulate booking data or gain unauthorized insight into user information.