CVE-2026-92421: CWE-639 Authorization Bypass Through User-Controlled Key in Hydra Booking — Appointment Scheduling & Booking Calendar
A vulnerability in the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before version 1.2.3 allows authenticated users with a host role to modify other hosts' profile data and reassign ownership of their records. This occurs because the plugin does not verify that the host record being modified belongs to the requesting user.
AI Analysis
Technical Summary
CVE-2026-92421 is an authorization bypass vulnerability (CWE-639) in the Hydra Booking WordPress plugin versions 1.1.0 up to but not including 1.2.3. The flaw arises from insufficient verification of ownership when an authenticated user with a host role attempts to modify host records. This allows such users to alter profile data of other hosts and reassign ownership of those records to themselves.
Potential Impact
Authenticated users assigned the host role can modify other hosts' profile information and take over their records. This could lead to unauthorized access or manipulation of booking data associated with other users.
Mitigation Recommendations
Upgrade the Hydra Booking plugin to version 1.2.3 or later, where this authorization verification issue has been addressed. No other mitigation guidance is provided.
CVE-2026-92421: CWE-639 Authorization Bypass Through User-Controlled Key in Hydra Booking — Appointment Scheduling & Booking Calendar
Description
A vulnerability in the Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before version 1.2.3 allows authenticated users with a host role to modify other hosts' profile data and reassign ownership of their records. This occurs because the plugin does not verify that the host record being modified belongs to the requesting user.
Affected software
Hydra Booking — Appointment Scheduling & Booking Calendar
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92421 is an authorization bypass vulnerability (CWE-639) in the Hydra Booking WordPress plugin versions 1.1.0 up to but not including 1.2.3. The flaw arises from insufficient verification of ownership when an authenticated user with a host role attempts to modify host records. This allows such users to alter profile data of other hosts and reassign ownership of those records to themselves.
Potential Impact
Authenticated users assigned the host role can modify other hosts' profile information and take over their records. This could lead to unauthorized access or manipulation of booking data associated with other users.
Mitigation Recommendations
Upgrade the Hydra Booking plugin to version 1.2.3 or later, where this authorization verification issue has been addressed. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-16T09:54:43.365Z
- State
- PUBLISHED
Threat ID: 6aae2c6955bf5e2cf5363ae1
Added to database: 09/19/2026, 06:32:09 UTC
Last enriched: 09/19/2026, 06:46:37 UTC
Last updated: 09/19/2026, 07:25:14 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.