What the vulnerability does
01Description
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
Explanation of Vulnerability in Simple Terms
02Summary
Hydra Booking versions up to 1.1.27 contain an integrity vulnerability that allows unauthenticated attackers to modify data via the network. The vulnerability requires no user interaction and affects the booking system's data integrity. Site administrators should update to a version newer than 1.1.27 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify booking or appointment data without authentication.
Potential impact on your site
04Site Impact
Attackers can alter booking records, appointments, or related data, potentially disrupting service or misleading customers.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 11, 2025
CVE published
April 8, 2026
Record updated
