PT-2026-4064 · Themefic · Hydra Booking

Published 2026-01-22 · Updated 2026-02-11 · CVE-2025-68027

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Themefic Hydra Booking versions through 1.1.32

Description A privilege assignment issue exists in Themefic Hydra Booking hydra-booking, potentially allowing privilege escalation. The issue allows for unauthorized access or actions due to incorrect privilege settings.

Recommendations Update Themefic Hydra Booking to a version later than 1.1.32.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-68027

Affected Products

Hydra Booking

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-68027 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-32-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2015362505330262456 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2021577362526106032 · Twitter Post