vulnerability
WordPress Plugin: hydra-booking: CVE-2025-12788: Client-Side Enforcement of Server-Side Security
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Nov 10, 2025 | Nov 11, 2025 | Nov 12, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Nov 10, 2025
Added
Nov 11, 2025
Modified
Nov 12, 2025
Description
The Hydra Booking — Appointment Scheduling and Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
Solution
hydra-booking-plugin-cve-2025-12788
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.