Access violation vulnerability in Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings 1.1.18

The plugin called Hydra Booking for WordPress has a security issue that could allow unauthorized users to gain higher access privileges. This is because the plugin does not check for certain abilities in a specific function, called tfhb_reset_password_callback(), in versions 1.1.0 to 1.1.18. As a result, attackers who are already logged in and have at least Subscriber-level access could reset the password of an Administrator user, giving them full control.