Is CVE-2026-42675 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42675 being exploited in the wild.

How severe is CVE-2026-42675?

High severity, with a CVSS score of 7.3, published 1 June 2026.

Which products and versions are affected?

Themefic Hydra Booking n/a through 1.1.41.

Is there a fix for CVE-2026-42675?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42675 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-42675?

Check whether you run Themefic Hydra Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42675: Themefic Hydra Booking missing authorization in WordPress plugin

CVE-2026-42675 · Severity: high · CVSS 7.3 · Published 2026-06-01

Themefic Hydra Booking, a WordPress plugin used for managing reservations and appointments, contains a security flaw that fails to properly verify user permissions. This allows unauthorized individuals to perform actions or access data that should be restricted to administrators. An exploit could lead to unauthorized changes to booking records, exposure of customer information, or disruption of the reservation service.

Technologies: Themefic Hydra Booking. Vendors: Themefic.

Quick answers

Is CVE-2026-42675 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42675 being exploited in the wild.
How severe is CVE-2026-42675?: High severity, with a CVSS score of 7.3, published 1 June 2026.
Which products and versions are affected?: Themefic Hydra Booking n/a through 1.1.41.
Is there a fix for CVE-2026-42675?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42675 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-42675?: Check whether you run Themefic Hydra Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the Themefic Hydra Booking plugin for WordPress through version 1.1.41. The flaw stems from incorrectly configured access control security levels, where sensitive functions fail to validate the authorization or authentication status of the requester. An unauthenticated remote attacker can exploit this by sending crafted network requests to trigger these functions, potentially leading to unauthorized data modification or disclosure. The issue is resolved in version 1.1.42.

Affected products

Themefic Hydra Booking n/a through 1.1.41

Timeline

2026-04-15: other: Reported by researcher raihan adi arba
2026-05-15: advisory: Patchstack advisory published
2026-06-01: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-41-broken-access-control-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.