CVE-2025-12788

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.

• CWE-602

• https://plugins.trac.wordpress.org/changeset/3392864/hydra-booking/tags/1.1.28/app/Shortcode/HydraBookingShortcode.php?old=3392467&old_path=hydra-booking%2Ftags%2F1.1.27%2Fapp%2FShortcode%2FHydraBookingShortcode.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ce4a2-52ad-4824-86fc-5edd2e33802d?source=cve

Published

Nov 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-12781When passing data to the b64decode(), standard_b64decode(), …5.3
• CVE-2025-12782The Beaver Builder – WordPress Page Builder plugin for WordP…4.3
• CVE-2025-12783The Premmerce Brands for WooCommerce plugin for WordPress is…4.3
• CVE-2025-12784Certain HP LaserJet Pro printers may be vulnerable to inform…4.9
• CVE-2025-12785Certain HP LaserJet Pro printers may be vulnerable to inform…7.5
• CVE-2025-12787The Hydra Booking — Appointment Scheduling & Booking Calenda…5.3
• CVE-2025-12789A flaw was found in Red Hat Single Sign-On. This issue is an…6.1
• CVE-2025-1279The BM Content Builder plugin for WordPress is vulnerable to…8.8
• CVE-2025-12790A flaw was found in Rubygem MQTT. By default, the package us…7.4
• CVE-2025-12792The Mac App Store distribution of the Canva for Mac desktop …3.2
• CVE-2025-12793An uncontrolled DLL loading path vulnerability exists in Asu…7.8
• CVE-2025-12799A flaw was found in Jastow. Jastow is vulnerable to Cross-Si…6.5