Hydra Booking WordPress Plugin Unauthenticated Arbitrary Booking Cancellation Vulnerability

A vulnerability exists in the Hydra Booking WordPress plugin, specifically in the Appointment Scheduling & Booking Calendar component, all versions through 1.1.27. The issue allows unauthenticated users to cancel bookings arbitrarily. This vulnerability arises because the plugin's booking cancellation tokens are generated using insufficiently random values, coupled with a globally shared nonce. As a result, attackers can exploit this weakness by conducting brute force attacks on the tfhb_meeting_form_cencel AJAX endpoint to cancel bookings.

Impact

Exploitation of this vulnerability allows for unauthorized cancellation of bookings, potentially disrupting scheduled appointments and causing inconvenience to users and service providers.

Remediation

Users can update to version 1.1.28 or a newer patched version to address this vulnerability.