CVE-2025-7689
Hydra Booking 1.1.0 - 1.1.18 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.
| CWE | CWE-862 |
| Vendor | themefic |
| Product | hydra booking – all in one appointment booking system | appointment scheduling, booking calendar & woocommerce bookings |
| Published | Jul 29, 2025 |
| Last Updated | Jul 29, 2025 |
Stay Ahead of the Next One
Get instant alerts for themefic hydra booking – all in one appointment booking system | appointment scheduling, booking calendar & woocommerce bookings
Be the first to know when new high vulnerabilities affecting themefic hydra booking – all in one appointment booking system | appointment scheduling, booking calendar & woocommerce bookings are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
themefic / Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings
1.1.0 ≤ 1.1.18
References
Credits
Kenneth Dunn