CVE-2026-42675: WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability affects the Hydra Booking WordPress plugin by Themefic at version 1.1.41 and earlier. The flaw is reachable over the network without any authentication or user interaction, meaning any unauthenticated remote request can trigger the misconfigured authorization checks. Successful exploitation gives an attacker limited read access, the ability to modify data, and the ability to disrupt service availability within the plugin's scope. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation to exploit it.

• AuthenticationNot required

  No account or credentials of any privilege level are needed; the misconfigured access control can be reached by any unauthenticated request.

• Victim interactionNot required

  No action from a logged-in user or site visitor is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special timing, or specific environmental configuration to succeed.

Blast Radius

• An attacker can read data accessible through the plugin, such as booking records or configuration details that should be restricted.
• An attacker can modify plugin data, including creating, updating, or deleting booking entries or settings without authorization.
• An attacker can trigger availability disruption within the plugin's functional scope, degrading or breaking the booking feature for site visitors.
• Because no authentication is required, these actions are open to any external actor who can reach the WordPress site over the internet.