CVE-2026-12433 is an insecure direct object reference vulnerability in the Hydra Booking – Appointment Scheduling & Booking Calendar WordPress plugin (<=1.2.1). The /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint uses the getBookingDetails() callback, which enforces the tfhb_manage_options capability but fails to verify that the requested booking belongs to the authenticated host. The lookup filters only by booking ID, allowing any authenticated user with the Hydra Host role (which grants tfhb_manage_options) to enumerate and view sensitive booking records of other hosts, including personal and payment information.

Authenticated users with Hydra Host-level privileges can access sensitive booking data belonging to other hosts. This includes attendee names, emails, phone numbers, addresses, meeting details, payment methods and statuses, transaction histories, and internal notes. The exposure of this data can lead to privacy violations and unauthorized disclosure of personal and financial information. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Hydra Host-level access to trusted users only to limit exposure. Monitor for updates from the vendor or plugin author regarding an official fix or patch.