Junglewise Threat Intelligence

CVE-2026-12433: Themefic Hydra Booking IDOR in booking details endpoint

CVE-2026-12433 · Severity: medium · CVSS 4.3 · Published 2026-07-09

Technologies: Themefic Hydra Booking. Vendors: Themefic.

Executive brief

The Hydra Booking plugin for WordPress, used for managing appointments and schedules, contains a security flaw that allows certain users to view private booking information. An attacker with a basic 'Host' account can access sensitive details belonging to other hosts, such as customer names, emails, phone numbers, and payment history. This could lead to a significant breach of customer privacy and the exposure of internal business notes.

Technical details

The Hydra Booking plugin is vulnerable to an Insecure Direct Object Reference (IDOR) via the '/wp-json/hydra-booking/v1/booking/details/{id}' REST endpoint. The 'getBookingDetails()' callback function validates that a user has the 'tfhb_manage_options' capability but fails to verify if the requested booking ID actually belongs to the authenticated user. An attacker with 'Hydra Host' level permissions or higher can exploit this by iterating through booking IDs to retrieve sensitive data, including attendee PII, meeting details, and transaction history. The vulnerability exists because 'getBookingDetailsData()' filters records solely based on the user-supplied ID without ownership checks.

Affected products

  • Themefic Hydra Booking – Appointment Scheduling & Booking Calendar up to, and including, 1.2.1

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References

Related threats