CVE-2026-12433 describes an authorization bypass vulnerability in the Hydra Booking – Appointment Scheduling & Booking Calendar WordPress plugin. The issue exists in the /wp-json/hydra-booking/v1/booking/details/{id} REST endpoint where the getBookingDetails() function enforces only the tfhb_manage_options capability but does not verify that the booking ID requested belongs to the authenticated host. Consequently, an attacker with Hydra Host-level privileges can enumerate booking IDs to access sensitive booking records of other hosts, including attendee personal information, meeting details, payment data, and internal notes. This vulnerability affects versions up to and including 1.2.1. No official patch or remediation guidance is currently provided.

An authenticated user with Hydra Host-level access can view sensitive information of bookings belonging to other hosts. This includes attendee names, emails, phone numbers, addresses, meeting details, payment methods and statuses, transaction histories, and internal notes. The confidentiality of booking data is compromised. There is no indication of impact to integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Hydra Host-level access to trusted users only to limit exposure. Monitor for updates from the vendor or plugin maintainers regarding a security patch or official fix.