CVE-2026-92420: Hydra Booking WordPress Auth Bypass Flaw

CVE-2026-92420 Overview

CVE-2026-92420 affects the Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress in versions before 1.2.2. The plugin fails to verify booking ownership before processing modification or deletion requests on two booking endpoints. An authenticated user with booking-provider privileges can cancel and permanently delete bookings that belong to other providers on the same site. The flaw is classified as an Insecure Direct Object Reference [CWE-639].

Critical Impact
A booking-provider-level account can tamper with or destroy scheduling data owned by other providers, disrupting appointment operations across the site.

Affected Products

Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin, all versions before 1.2.2
WordPress sites where multiple booking providers share the same instance
Multi-tenant scheduling deployments relying on Hydra Booking for appointment management

Discovery Timeline

2026-09-19 - CVE-2026-92420 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92420

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the Hydra Booking plugin's booking management endpoints. Two endpoints responsible for modifying and deleting bookings accept a booking identifier from the request without validating that the identifier belongs to the authenticated provider. Because the plugin enforces role-based authentication but omits per-object authorization, any user holding the booking-provider role can operate on arbitrary booking records.

Exploitation requires a valid booking-provider account, which raises the privilege bar and limits exposure to insider-style abuse or compromised provider accounts. Successful abuse leads to integrity and availability impacts on booking data, while confidentiality of unrelated site data is not directly affected.

Root Cause

The root cause is missing authorization at the object level. The affected endpoints check that the caller is authenticated and holds the booking-provider capability, but they do not compare the target booking's owner field against the caller's user ID. This omission matches the pattern described in CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker authenticates to the target WordPress site with a booking-provider account. The attacker then issues requests to the vulnerable cancel and delete endpoints, substituting booking identifiers belonging to other providers. The server processes the requests without ownership checks and cancels or removes the targeted bookings. Refer to the WPScan Vulnerability Report for endpoint-level detail.

Detection Methods for CVE-2026-92420

Indicators of Compromise

Unexpected cancellation or deletion events in Hydra Booking logs affecting bookings not owned by the acting provider account
Booking-provider accounts issuing high volumes of requests to the plugin's cancel or delete endpoints in short intervals
Customer complaints about missing or cancelled appointments that were not initiated by the assigned provider

Detection Strategies

Correlate WordPress audit logs with Hydra Booking database records to flag deletion or status-change events where the actor user ID does not match the booking's provider ID
Enable verbose logging on the plugin's REST or admin-ajax endpoints and alert on identifier enumeration patterns
Monitor for booking record deletions occurring outside standard business workflows

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized SIEM for correlation across provider accounts
Track baseline cancellation and deletion rates per provider and alert on statistical outliers
Review provider account activity following any credential reset or new provider onboarding event

How to Mitigate CVE-2026-92420

Immediate Actions Required

Upgrade the Hydra Booking plugin to version 1.2.2 or later on all WordPress sites where it is installed
Audit existing booking-provider accounts and remove any that are unused or unrecognized
Review booking records for unauthorized cancellations or deletions since the plugin was deployed

Patch Information

The vendor addressed CVE-2026-92420 in Hydra Booking version 1.2.2. The fix introduces ownership verification on the affected booking modification and deletion endpoints. Patch details are documented in the WPScan Vulnerability Report.

Workarounds

Restrict the booking-provider role to trusted users only until the plugin is updated
Place the WordPress admin and REST endpoints behind a web application firewall with rules that limit request rates to the plugin's booking endpoints
Enforce strong authentication, including multi-factor authentication, on all provider accounts to reduce risk of account compromise

bash

# Update the Hydra Booking plugin using WP-CLI
wp plugin update hydra-booking --version=1.2.2
wp plugin list --name=hydra-booking --fields=name,status,version