CyberRota Analysis
AI-GeneratedThe Hydra Booking plugin for WordPress prior to version 1.2.2 is vulnerable due to insufficient verification of user permissions, enabling booking-provider-level users to modify or delete bookings belonging to other providers. This flaw can lead to unauthorized cancellations and permanent deletions of bookings, compromising the integrity of the booking system. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential abuse.
Original NVD Description
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.