CVE-2026-42675— WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Themefic | Hydra Booking | n/a≤ 1.1.41 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42675
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Themefic | Hydra Booking | n/a ~ 1.1.41 | - |
II. Public POCs for CVE-2026-42675
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42675
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42675 (1)
IV. Related Vulnerabilities
Same product: Hydra Booking
- CVE-2026-39541
WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Script - CVE-2025-68027
WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalat - CVE-2025-68055
WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vul - CVE-2025-49378
WordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vul - CVE-2025-49377
WordPress Hydra Booking plugin <= 1.1.9 - Broken Access Cont
Same vendor: Themefic
- CVE-2026-39571
WordPress Instantio plugin <= 3.3.30 - Sensitive Data Exposu - CVE-2026-39543
WordPress Tourfic plugin <= 2.21.4 - Broken Access Control v - CVE-2026-39541
WordPress Hydra Booking plugin <= 1.1.38 - Cross Site Script - CVE-2026-32460
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.3 - CVE-2026-24940
WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access
Same weakness: CWE-862
- CVE-2026-45285
Nextcloud: Hidden Public Link creation when sharing to a Tea - CVE-2026-42671
WordPress GeoDirectory plugin <= 2.8.157 - Broken Access Con - CVE-2026-42677
WordPress WP Document Revisions plugin <= 3.8.1 - Broken Acc - CVE-2026-42682
WordPress wpForo Forum plugin <= 3.0.6 - Broken Access Contr - CVE-2026-40543
Missing Authorization in SOPlanning
V. Comments for CVE-2026-42675
No comments yet