CVE-2025-7689: Themefic Hydra Booking – All In One Appointment Booking System | Appointment Scheduling, Booking Calendar & Woocommerce Bookings

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.

Affected products

• Themefic Hydra Booking – All In One Appointment Booking System | Appointment Scheduling, Booking Calendar & Woocommerce Bookings: from 1.1.0, up to and including 1.1.18

Published 2025-07-29. Last modified 2026-06-17.