Quang

**Name of the Vulnerable Software and Affected Versions** Hydra Booking – Appointment Scheduling & Booking Calendar versions prior to 1.2.2 **Description** An Insecure Direct Object Reference exists in the `/wp-json/hydra-booking/v1/booking/details/{id}` REST endpoint. The `getBookingDetails()` callback enforces the `tfhb manage options` capability through `tfhb manage options permission()` but fails to verify if the requested booking belongs to the authenticated host. Because the `getBookingDetailsData()` function filters only by the booking ID provided in the URL, authenticated attackers with Hydra Host-level access or higher can view sensitive booking records of other hosts. Exposed data includes attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes. **Recommendations** Update the plugin to a version newer than 1.2.1. Restrict access to the `/wp-json/hydra-booking/v1/booking/details/{id}` endpoint to minimize the risk of unauthorized data exposure.