{"id":"CVE-2026-92420","title":"The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking…","summary":"The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking…","severity":"low","cvss":3.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-639"],"product":"Hydra Booking — Appointment Scheduling & Booking Calendar","affected":["hydra_booking_appointment_scheduling_booking_calendar < 1.2.2"],"published":"2026-09-19","updated":"2026-09-21","sourceUpdated":"2026-09-21T13:34:57.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92420","references":[{"url":"https://wpscan.com/vulnerability/3685e160-f3a4-4772-b2e3-f6155894ab4c/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.00188,"epssPercentile":0.08622,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-19T13:10:55.572770Z"},"ingestedAt":"2026-09-19T06:59:13.115Z","slug":"CVE-2026-92420","body":"## Overview\n\nThe Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207716,"id":"CVE-2026-92420","ts":1789826664761,"field":"cvss","old":null,"new":"3.8"},{"seq":207715,"id":"CVE-2026-92420","ts":1789826664761,"field":"severity","old":"none","new":"low"}]}