PT-2025-46323 · WordPress+1 · Hydra Booking+1

Ahmad Salem · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12788

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress versions prior to 1.1.28

Description The Hydra Booking plugin for WordPress has a flaw where payment verification is absent, allowing unauthenticated users to bypass payment requirements. This occurs because the plugin accepts payment confirmation data provided by the client in the tfhb meeting paypal payment confirmation callback function without validating it with the PayPal API. This enables attackers to confirm bookings as paid without completing an actual payment.

Recommendations Update the Hydra Booking plugin to version 1.1.28 or later.

Fix

Weakness Enumeration

CWE-602

Related Identifiers

CVE-2025-12788

Affected Products

Hydra Booking

Paypal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12788 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve · Note
• https://t.me/CVEtracker/37024 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php · Note
• https://twitter.com/CVEnew/status/1988210487411306513 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988321705207488737 · Twitter Post
• https://t.me/cveNotify/142396 · Telegram Post