CVE-2026-92425

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.4

Description The plugin fails to perform object-level authorization checks on several host-management operations. This allows users assigned to a specific custom administrator role to read, modify, and permanently delete records belonging to other hosts, as well as the WordPress user accounts associated with them.

Recommendations Update the plugin to version 1.2.4 or later.