CVE-2026-28188

The CVSS 7.3 score on this Hydra Booking vulnerability fundamentally understates your operational risk—not because the math is wrong, but because it can't capture what happens when unauthenticated actors hit a booking system with sequential IDs. You're not looking at a targeted account compromise. You're looking at mass enumeration of customer data that requires zero skill beyond iterating through numbers. A booking plugin exposes your entire reservation surface to anyone who asks: customer names, contact details, appointment times, internal notes, staff assignments. An attacker doesn't need credentials—they need a script and a window of time. There is no account lockout because there's no login attempt. There's no session to flag for rate limiting. The system will faithfully return whatever lives at each booking ID, in structured JSON format, ready for programmatic extraction. This changes how you should think about the patch priority. The EPSS of 0.00219 reflects current threat actor activity, not intrinsic severity. Once a scanner rule or Metasploit module lands, this becomes a zero-skill exploit—the same pattern that's been CVE'd across the WordPress ecosystem repeatedly since the REST API became standard. Your patching latency is the asymmetry: defenders need authorization, staging, and deployment; attackers need one working script. Check your Hydra Booking version immediately. If this is a regression from an earlier version where access control was correct, the development delta reveals what broke in review—which matters for understanding your current exposure. If the plugin shows sparse commit activity or unclear maintenance status, treat this as a higher priority: abandoned plugins with known CVEs become permanent features of your attack surface. The client roster, appointment patterns, and staff structure exposed through booking enumeration creates exactly the organizational intelligence that enables targeted social engineering campaigns. Your immediate actions: identify all WordPress instances running this plugin, verify the current version, apply the patch on priority if available, and assume that until patched, your booking data is programmatically enumerable. Monitor for unusual access patterns to booking API endpoints—even though traditional rate limiting won't catch this, anomaly detection on endpoint volume can surface mass enumeration attempts.

Reviewed through automated stages and approved by a human before publication.