EUVD-2025-84362

🗓️ 11 Nov 2025 12:30:18Reported by EUVDType

Hydra Booking WordPress plugin allows unauthorized cancellation of bookings via weak tokens and a shared nonce, affecting all versions up to 1.1.27.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12787	11 Nov 202512:04	–	circl
CNNVD	WordPress plugin Hydra Booking — Appointment Scheduling & Booking Calendar 安全特征问题漏洞	11 Nov 202500:00	–	cnnvd
CVE	CVE-2025-12787	11 Nov 202511:03	–	cve
Cvelist	CVE-2025-12787 Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation	11 Nov 202511:03	–	cvelist
NVD	CVE-2025-12787	11 Nov 202511:15	–	nvd
Patchstack	WordPress Hydra Booking plugin <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation vulnerability	11 Nov 202501:22	–	patchstack
Positive Technologies	PT-2025-46322	11 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12787	12 Nov 202512:06	–	redhatcve
Vulnrichment	CVE-2025-12787 Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation	11 Nov 202511:03	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025)	20 Nov 202516:10	–	wordfence

[
  {
    "enisaIdVendor": [
      {
        "id": "1240ab7e-d8cd-3b0f-b2d1-b6c0e32e9b83",
        "vendor": {
          "name": "Themefic"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "508d547a-a64b-3fff-8bd4-a0a7f290c9dc",
        "product": {
          "name": "Hydra Booking — Appointment Scheduling & Booking Calendar"
        },
        "product_version": "* ≤1.1.27"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/490dd84f-7c03-43c7-b4e1-167fa2b15c03
plugins	www.plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-12787

11 Nov 2025 12:30Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.3

EPSS0.00123