WordPress Hydra Booking plugin <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation vulnerability

🗓️ 11 Nov 2025 01:22:00Reported by Ahmad Salem (a7mad.cc)Type

WordPress Hydra Booking plugin versions up to 1.1.27 have broken access control; fixed in 1.1.28.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-12787	11 Nov 202512:04	–	circl
CNNVD	WordPress plugin Hydra Booking — Appointment Scheduling & Booking Calendar 安全特征问题漏洞	11 Nov 202500:00	–	cnnvd
CVE	CVE-2025-12787	11 Nov 202511:03	–	cve
Cvelist	CVE-2025-12787 Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation	11 Nov 202511:03	–	cvelist
EUVD	EUVD-2025-84362	11 Nov 202512:30	–	euvd
NVD	CVE-2025-12787	11 Nov 202511:15	–	nvd
Positive Technologies	PT-2025-46322	11 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12787	12 Nov 202512:06	–	redhatcve
Vulnrichment	CVE-2025-12787 Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation	11 Nov 202511:03	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (November 10, 2025 to November 16, 2025)	20 Nov 202516:10	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hydra-booking/hydra-booking-all-in-one-appointment-booking-system-appointment-scheduling-booking-calendar-woocommerce-bookings-1127-unauthenticated-arbitrary-booking-cancellation-via-weak-hash-generation

11 Nov 2025 01:22Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3

EPSS0.00123

SSVC