Veille CVE

Recherche « Unknown Hydra Booking — Appointment Scheduling & Booking Calendar »

3 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Hydra Booking — Appointment Scheduling & Booking Calendar » ✕
  1. CVE-2026-92425 5.5 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

  2. CVE-2026-92421 4.7 Moyenne

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

  3. CVE-2026-92420 3.8 Faible

    Unknown Hydra Booking — Appointment Scheduling & Booking Calendar

    The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.