CVE-2025-12788 describes a vulnerability in the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin where the function tfhb_meeting_paypal_payment_confirmation_callback accepts payment confirmation data controlled by the client without server-side verification against PayPal's API. This missing server-side payment verification allows unauthenticated attackers to bypass payment requirements and mark bookings as paid without any legitimate transaction. The issue affects all plugin versions up to 1.1.27 and is categorized as CWE-602, reflecting improper reliance on client-side enforcement for security-critical operations.

An attacker can bypass payment requirements and confirm bookings as paid without making any actual payment transaction. This leads to unauthorized access to paid services or appointments without financial exchange, potentially causing revenue loss for the service provider. There is no impact on confidentiality or availability reported, only integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider disabling the affected payment confirmation functionality or implementing additional server-side verification controls to validate payment status independently.