CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.
Explanation of Vulnerability in Simple Terms
Hydra Booking versions 1.1.0 through 1.1.18 lack proper authorization checks, allowing authenticated users to read, modify, or delete booking data and settings they should not have access to. An attacker with a low-privilege account can escalate their capabilities within the plugin without additional interaction. Site administrators should update immediately to a version newer than 1.1.18.
What an attacker can do
Read, modify, or delete bookings and settings belonging to other users or the site.
Potential impact on your site
Booking data, customer information, and plugin settings can be compromised by any logged-in user.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
