Weak configuration vulnerability in Hydra Booking — Appointment Scheduling & Booking Calendar 1.1.27

The Hydra Booking plugin for WordPress allows users to schedule and book appointments. However, there is a security vulnerability in all versions up to 1.1.27 that allows unauthorized cancellation of bookings. This is because the plugin’s function for submitting meeting forms uses weak values to create cancellation tokens, which are shared globally. This means that someone without proper authorization could potentially cancel any booking by using brute force attacks on the plugin’s AJAX endpoint.