CVE-2026-92425

Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin versions before 1.2.4 lack object-level authorisation checks on host-management operations, creating an IDOR vulnerability. Users holding the plugin's own administrator-assigned custom role can read, modify, and permanentl...