[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjNDhLvjKoS2LBNB7f-IfetR-MpypkpxtxEj4w-xjBUw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-12433","hydra-booking-authenticated-custom-insecure-direct-object-reference-to-sensitive-information-exposure-via-bookingid-para","Hydra Booking \u003C= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter","The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.2.1 via the \u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F{id} REST endpoint. This is due to the getBookingDetails() callback only enforcing the tfhb_manage_options capability via tfhb_manage_options_permission(), without verifying that the requested booking belongs to the currently authenticated host (the lookup in getBookingDetailsData() filters solely on the booking id supplied in the URL). This makes it possible for authenticated attackers, with Hydra Host-level access and above (a role created by the plugin which grants tfhb_manage_options), to view sensitive booking records belonging to other hosts, including attendee names, emails, phone numbers, addresses, meeting details, payment method and status, transaction history, and internal notes by iterating booking IDs.","hydra-booking",null,"\u003C=1.2.1","1.2.2","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-08 20:27:39","2026-07-09 08:31:35",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Faa00fe53-dc65-4200-80bb-9167b4230194?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002FController\u002FBookingController.php","admin\u002FController\u002FMeetingController.php","admin\u002FController\u002FSetupWizard.php","admin\u002FController\u002FTransStrings.php","app\u002FContent\u002FTemplate\u002Fmeeting-confirmation.php","build\u002Fassets\u002Ftfhb-admin-app-script.js","build\u002Fassets\u002Ftfhb-admin-app.css","hydra-booking.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-12433 (Hydra Booking IDOR)\n\n## 1. Vulnerability Summary\nThe **Hydra Booking** plugin for WordPress is vulnerable to an **Insecure Direct Object Reference (IDOR)** in its REST API. Specifically, the endpoint `\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F{id}` allows any user with the `tfhb_host` role to view the booking details of any other host. \n\nWhile the plugin implements a permission check (`tfhb_manage_options_permission`) that restricts access to \"Hosts,\" it fails to verify if the requested `{id}` belongs to the authenticated user. An attacker can iterate through booking IDs to expose sensitive attendee information, including names, emails, phone numbers, and meeting locations.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F(?P\u003Cid>[0-9]+)`\n- **HTTP Method:** `GET`\n- **Authentication:** Required. Any user with the `tfhb_host` role or the `tfhb_manage_options` capability.\n- **Vulnerable Parameter:** The `id` path variable in the URL.\n- **Preconditions:** The attacker must be logged in as a \"Host\" (a custom role created by the plugin).\n\n## 3. Code Flow\n1. **Route Registration:** In `admin\u002FController\u002FBookingController.php`, the route is registered:\n   ```php\n   register_rest_route(\n       'hydra-booking\u002Fv1',\n       '\u002Fbooking\u002Fdetails\u002F(?P\u003Cid>[0-9]+)',\n       array(\n           'methods'  => 'GET',\n           'callback' => array( $this, 'getBookingDetails' ),\n           'permission_callback' =>  array(new RouteController() , 'tfhb_manage_options_permission'),\n       )\n   );\n   ```\n2. **Permission Check:** `RouteController::tfhb_manage_options_permission` verifies if the user has the `tfhb_manage_options` capability. This capability is granted to the `tfhb_host` role.\n3. **Vulnerable Callback:** The `getBookingDetails` callback (defined in `BookingController.php`) is executed. According to the vulnerability description, this function (and its helper `getBookingDetailsData`) retrieves booking data based purely on the `id` provided in the URL without checking the `host_id` against the current user's host ID.\n4. **Existing (Unused) Protection:** Note that `BookingController` contains a function `tfhb_verify_booking_ownership( $booking_id )` (line 33) designed to check if a booking belongs to a host, but this function is **not** invoked in the `permission_callback` for the details endpoint.\n\n## 4. Nonce Acquisition Strategy\nThe WordPress REST API requires a `_wpnonce` for authenticated requests to prevent CSRF, usually passed in the `X-WP-Nonce` header.\n\n1. **Role Setup:** The `tfhb_host` role is required.\n2. **Dashboard Access:** Logged-in hosts access the plugin via `wp-admin\u002Fadmin.php?page=hydra-booking`.\n3. **Nonce Extraction:**\n   - Navigate to `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=hydra-booking`.\n   - The plugin likely localizes its settings. Common Hydra Booking localization variables include `tfhb_admin_data`.\n   - Use `browser_eval` to extract the REST nonce from the standard WordPress `wpApiSettings` or the plugin-specific object.\n   - **Command:** `browser_eval(\"window.wpApiSettings?.nonce\")` or `browser_eval(\"window.tfhb_admin_data?.nonce\")`.\n\n## 5. Exploitation Strategy\n1. **Setup Phase:**\n   - Create a \"Victim\" user with the `tfhb_host` role.\n   - Create an \"Attacker\" user with the `tfhb_host` role.\n   - As the Victim, create a booking. Record the ID (e.g., `1`).\n2. **Execution Phase:**\n   - Authenticate as the Attacker.\n   - Obtain a REST nonce (see Section 4).\n   - Send a `GET` request to the target endpoint targeting the Victim's booking ID.\n3. **Request Details:**\n   - **Method:** `GET`\n   - **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F[VICTIM_BOOKING_ID]`\n   - **Headers:** \n     - `X-WP-Nonce: [EXTRACTED_NONCE]`\n     - `Content-Type: application\u002Fjson`\n\n## 6. Test Data Setup\n1. **Create Roles (if not automatic):** Ensure the plugin is activated so it creates the `tfhb_host` role.\n2. **Create Users:**\n   - `wp user create victim victim@example.com --role=tfhb_host --user_pass=password`\n   - `wp user create attacker attacker@example.com --role=tfhb_host --user_pass=password`\n3. **Seed Data:**\n   - Since the plugin uses custom tables (e.g., `{$wpdb->prefix}tfhb_bookings`), use the UI or `wp db query` to insert a booking for the Victim. \n   - A booking requires a `host_id`. Ensure the Victim user has an entry in the `tfhb_hosts` table linked to their `user_id`.\n   - Use the `SetupWizard::CreateHost` logic or manually link:\n     `wp db query \"INSERT INTO wp_tfhb_hosts (user_id, email, status) VALUES ([VICTIM_UID], 'victim@example.com', 'activate')\"`\n     `wp db query \"INSERT INTO wp_tfhb_bookings (host_id, status, meeting_title) VALUES ([VICTIM_HOST_ID], 'confirmed', 'Secret Strategy Meeting')\"`\n\n## 7. Expected Results\n- The server returns a `200 OK` response.\n- The JSON response body contains sensitive information:\n  - `meeting_title`\n  - `attendee_details` (Name, Email, etc.)\n  - `meeting_locations` (Zoom links, addresses)\n  - `internal_notes`\n\n## 8. Verification Steps\n1. **Check Response:** Confirm the JSON contains the string \"Secret Strategy Meeting\" (or whatever title was seeded).\n2. **Verify IDOR:** Ensure the Attacker's own host ID is different from the Victim's host ID by checking the database:\n   `wp db query \"SELECT id, user_id FROM wp_tfhb_hosts\"`\n\n## 9. Alternative Approaches\nIf the `details` endpoint is patched or behaves differently, try other routes registered in `BookingController::create_endpoint()` that use the same `permission_callback`:\n- `\u002Fbooking\u002F(?P\u003Cid>[0-9]+)` (Calls `getBookingData`)\n- `\u002Fbooking\u002Fupdate-internal-note` (POST request, may allow modification of other hosts' notes)\n- `\u002Fbooking\u002Fcancel-booking-attendee` (POST request, may allow cancelling other hosts' meetings)\n\nAll these routes use `tfhb_manage_options_permission` and likely suffer from the same lack of ownership validation.","The Hydra Booking plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in its REST API. Authenticated attackers with the 'tfhb_host' role can access sensitive booking details of any user by manipulating the 'id' parameter in the \u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F{id} endpoint, as the plugin fails to verify booking ownership.","\u002F\u002F admin\u002FController\u002FBookingController.php:125\n\t\t\u002F\u002F Get Single Booking based on id\n\t\tregister_rest_route(\n\t\t\t'hydra-booking\u002Fv1',\n\t\t\t'\u002Fbooking\u002Fdetails\u002F(?P\u003Cid>[0-9]+)',\n\t\t\tarray(\n\t\t\t\t'methods'  => 'GET',\n\t\t\t\t'callback' => array( $this, 'getBookingDetails' ),\n\t\t\t\t'permission_callback' =>  array(new RouteController() , 'tfhb_manage_options_permission'),\n\t\t\t)\n\t\t);","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.2.1\u002Fadmin\u002FController\u002FBookingController.php\t2026-06-28 07:15:40.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fhydra-booking\u002F1.2.2\u002Fadmin\u002FController\u002FBookingController.php\t2026-07-08 10:48:44.000000000 +0000\n@@ -900,6 +900,9 @@\n \t\t$booking = new Booking();\n \n \t\tif ( ! empty( $request['id'] ) ) {\n+\t\t\tif ( ! $this->tfhb_verify_booking_ownership( $request['id'] ) ) {\n+\t\t\t\treturn new \\WP_Error( 'rest_forbidden', __( 'You are not allowed to access this booking.', 'hydra-booking' ), array( 'status' => 403 ) );\n+\t\t\t}\n \t\t\t$data = array(\n \t\t\t\t'id'                 => isset( $request['id'] ) ? $request['id'] : '',\n \t\t\t\t'meeting_id'         => isset( $request['meeting'] ) ? $request['meeting'] : '',\n@@ -998,6 +1001,11 @@\n \t\t\t\t)\n \t\t\t);\n \t\t}\n+\n+\t\tif ( ! $this->tfhb_verify_booking_ownership( $booking_id ) ) {\n+\t\t\treturn new \\WP_Error( 'rest_forbidden', __( 'You are not allowed to access this booking.', 'hydra-booking' ), array( 'status' => 403 ) );\n+\t\t}\n+\n \t\t\u002F\u002F Delete Booking\n \t\t$booking       = new Booking();\n \t\t$single_booking_meta = $booking->get( absint( $booking_id ) );\n@@ -1160,6 +1168,10 @@\n \t\t\t);\n \t\t}\n \n+\t\tif ( ! $this->tfhb_verify_booking_ownership( $attendeeBooking->booking_id ) ) {\n+\t\t\treturn new \\WP_Error( 'rest_forbidden', __( 'You are not allowed to access this booking.', 'hydra-booking' ), array( 'status' => 403 ) );\n+\t\t}\n+\n \t\tif( 'confirmed' != $attendeeBooking->status ){\n \t\t\treturn rest_ensure_response(\n \t\t\t\tarray(\n@@ -1217,6 +1229,11 @@\n \t\t\t\t)\n \t\t\t);\n \t\t}\n+\n+\t\tif ( ! $this->tfhb_verify_booking_ownership( $attendeeBooking->booking_id ) ) {\n+\t\t\treturn new \\WP_Error( 'rest_forbidden', __( 'You are not allowed to access this booking.', 'hydra-booking' ), array( 'status' => 403 ) );\n+\t\t}\n+\n \t\tif($attendeeBooking->status == $status){\n \t\t\treturn rest_ensure_response(\n \t\t\t\tarray(\n@@ -1667,6 +1684,10 @@\n \t\t\t);\n \t\t}\n \n+\t\tif ( ! $this->tfhb_verify_booking_ownership( $booking_id ) ) {\n+\t\t\treturn new \\WP_Error( 'rest_forbidden', __( 'You are not allowed to access this booking.', 'hydra-booking' ), array( 'status' => 403 ) );\n+\t\t}\n+\n \t\t$data = array(\n \t\t\t'id'     => $request['id'],\n \t\t\t'status' => isset( $request['status'] ) ? sanitize_text_field( $request['status'] ) : '',\n@@ -1762,6 +1783,8 @@\n \t\t$items    = $request['items'];\n \t\t$booking_owner = !empty($request['host']) ? $request['host'] : '';\n \n+\t\t\u002F\u002F Only keep booking ids the current user is actually allowed to touch.\n+\t\t$items = ! empty( $items ) ? array_values( array_filter( $items, array( $this, 'tfhb_verify_booking_ownership' ) ) ) : $items;","1. Gain access to a WordPress account with the 'tfhb_host' role (or any role possessing the 'tfhb_manage_options' capability).\n2. Obtain a valid WordPress REST API nonce (typically found in the 'wpApiSettings' or 'tfhb_admin_data' JavaScript objects on the plugin's dashboard).\n3. Identify a target booking ID belonging to another host.\n4. Send an authenticated GET request to `\u002Fwp-json\u002Fhydra-booking\u002Fv1\u002Fbooking\u002Fdetails\u002F{id}`, replacing `{id}` with the target booking ID and including the nonce in the 'X-WP-Nonce' header.\n5. The server will respond with the full details of the booking, including attendee PII (name, email, phone) and internal host notes.","gemini-3-flash-preview","2026-07-15 22:24:41","2026-07-15 22:25:04",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.2.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags\u002F1.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhydra-booking.1.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags\u002F1.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fhydra-booking.1.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fhydra-booking\u002Ftags"]