CVE-2025-12788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12788", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T00:09:09.016Z", "datePublished": "2025-11-11T11:03:46.212Z", "dateUpdated": "2026-04-08T17:16:59.618Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:59.618Z"}, "affected": [{"vendor": "themefic", "product": "Hydra Booking \u2014 Appointment Scheduling & Booking Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.27", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Hydra Booking \u2014 Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring."}], "title": "Hydra Booking \u2013 All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-602 Client-Side Enforcement of Server-Side Security", "cweId": "CWE-602", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmad Salem"}], "timeline": [{"time": "2025-10-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-06T00:26:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-10T22:39:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:24:02.399959Z", "id": "CVE-2025-12788", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:29:25.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T15:24:02.399959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:24:03.179Z"}}], "cna": {"title": "Hydra Booking \u2013 All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Ahmad Salem"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "themefic", "product": "Hydra Booking \u2014 Appointment Scheduling & Booking Calendar", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.27"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-06T00:26:16.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-10T22:39:28.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php"}], "descriptions": [{"lang": "en", "value": "The Hydra Booking \u2014 Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602 Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-11T11:03:46.212Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12788", "state": "PUBLISHED", "dateUpdated": "2025-11-14T15:29:25.151Z", "dateReserved": "2025-11-06T00:09:09.016Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T11:03:46.212Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Hydra Booking \u2014 Appointment Scheduling & Booking Calendar", "vendor": "themefic", "versions": [{"lessThanOrEqual": "1.1.27", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Hydra Booking \u2014 Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring."}, {"lang": "es", "value": "El plugin Hydra Booking - Appointment Scheduling & Booking Calendar para WordPress es vulnerable a la ausencia de verificaci\u00f3n de pago, lo que permite la omisi\u00f3n de pagos no autenticados, en todas las versiones hasta la 1.1.27, inclusive. Esto se debe a que el plugin acepta datos de confirmaci\u00f3n de pago controlados por el cliente en la funci\u00f3n tfhb_meeting_paypal_payment_confirmation_callback sin verificaci\u00f3n del lado del servidor con la API de PayPal. Esto hace posible que atacantes no autenticados eludan los requisitos de pago y confirmen reservas como pagadas sin que se produzca ninguna transacci\u00f3n de pago real."}], "id": "CVE-2025-12788", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12788", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-14T15:24:02.399959Z", "version": "2.0.3"}}]}, "published": "2025-11-11T11:15:34.890", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:35:37.627920+00:00", "value": {"mitigation_remediation": ["Upgrade the Hydra Booking plugin to version 1.1.28 or later to apply the vendor fix.", "If an upgrade is not immediately feasible, modify the _tfhb_meeting_paypal_payment_confirmation_callback_ function to perform server\u2011side verification of PayPal responses using the PayPal API before accepting the confirmation.", "Restrict access to the payment confirmation endpoint so that only authenticated or signed requests from PayPal can reach it, for example by adding a secret key or IP whitelist."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Payment Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Themefic Hydra Booking \u2013 Appointment Scheduling & Booking Calendar plugin for WordPress versions up to and including 1.1.27. Users of older releases should verify their installed plugin version.", "description_and_impact": "The Hydra Booking plugin for WordPress allows client\u2011controlled payment confirmation data to be accepted by the \"tfhb_meeting_paypal_payment_confirmation_callback\" function without server\u2011side verification against PayPal.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, suggesting that exploitation is unlikely but still possible, especially if the site exposes the payment confirmation endpoint to the public. The flaw is not listed in CISA's KEV catalog, but its impact on financial transactions warrants caution. Attackers would likely trigger the callback by submitting forged data through the booking interface from any unauthenticated location."}}}}, "created": "2025-11-12T12:42:52.716742+00:00", "updated": "2026-04-22T00:45:04.154564+00:00", "vendors": ["themefic", "themefic$PRODUCT$hydra_booking", "wordpress", "wordpress$PRODUCT$wordpress"]}