PT-2025-46322 · WordPress · Hydra Booking

Ahmad Salem · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12787

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress versions prior to 1.1.28

Description The Hydra Booking plugin for WordPress is susceptible to unauthorized booking cancellations. This is caused by the use of predictable values in generating booking cancellation tokens and a globally shared nonce within the tfhb meeting form submit callback function. An unauthenticated attacker can cancel bookings by conducting brute-force attacks against the tfhb meeting form cencel API endpoint.

Recommendations Update the Hydra Booking plugin to version 1.1.28 or later.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2025-12787

Affected Products

Hydra Booking

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12787 · Security Note
• https://t.me/CVEtracker/37023 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/490dd84f-7c03-43c7-b4e1-167fa2b15c03?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1988324265267995048 · Twitter Post
• https://t.me/cveNotify/142395 · Telegram Post
• https://twitter.com/CVEnew/status/1988210489453896137 · Twitter Post