Introduction
On WordPress sites running Hydra Booking plugin versions 1.1.0 through 1.1.18, a Subscriber account is enough to reset an administrator's password. A malicious authenticated user who exploits this can escalate privileges and compromise the entire site.
Hydra Booking is a WordPress plugin for appointment scheduling and business management, with integrations for WooCommerce and CRM systems. It is marketed to businesses that need multi-user booking and a front-end dashboard. The plugin is widely used in the WordPress ecosystem, but it has not previously been linked to major security incidents.
Technical information
CVE-2025-7689 is a privilege escalation vulnerability in Hydra Booking WordPress plugin versions 1.1.0 through 1.1.18. The flaw is in the tfhb_reset_password_callback function, which handles password reset requests. In these versions, the function runs no capability check on the role or permissions of the user who calls it.
Without that check, any authenticated user, including one with only Subscriber-level access, can send a crafted request to the vulnerable endpoint. If the request specifies an Administrator's user ID, the attacker can reset that Administrator's password. The attacker then has full administrative access to the WordPress site.
The flaw is classified as CWE-862 (Missing Authorization), the weakness class for failing to enforce authorization on sensitive operations. Exploitation is straightforward for any authenticated user who can interact with the plugin's password reset functionality.
Affected systems and versions
- Product: Hydra Booking WordPress plugin
- Affected versions: 1.1.0 through 1.1.18
- Any WordPress installation running Hydra Booking in this version range is vulnerable if user registration or Subscriber-level accounts are enabled
Vendor security history
No prior public vulnerabilities in Hydra Booking have been widely reported. At the time of writing, there is no evidence of a vendor advisory or a rapid patch for CVE-2025-7689. The flaw raises concerns about the maturity of the plugin's security practices, particularly around authorization checks on sensitive operations.
