CVE-2025-68055CWE-89

WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability

High · published December 16, 2025

CVSS v3.1
8.5
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

⚡ A crafty SQL injection vulnerability in Themefic Hydra Booking could open the floodgates to your database! Think of SQL injection like a sneaky waiter who takes your order and quietly changes it behind the scenes. Instead of your desired dish, they serve you whatever they want while you’re not looking! 🚪🍽️ If an attacker exploits this vulnerability, they could manipulate your database at will — reading sensitive data, altering entries, or even deleting crucial information! This could lead to catastrophic data breaches or loss of customer trust, creating a truly alarming situation for your operations.

Put simply

Think of SQL injection like a sneaky waiter who takes your order and quietly changes it behind the scenes. Instead of your desired dish, they serve you whatever they want while you’re not looking! 🚪🍽️ This vulnerability allows attackers to inject malicious SQL code through unsanitized user input in the Themefic Hydra Booking plugin, affecting versions up to 1.1.32. This means that they might execute commands that could compromise your data integrity.

What to do

If an attacker exploits this vulnerability, they could manipulate your database at will — reading sensitive data, altering entries, or even deleting crucial information! This could lead to catastrophic data breaches or loss of customer trust, creating a truly alarming situation for your operations. To protect against this vulnerability, immediately update to the latest version of Themefic Hydra Booking. Additionally, ensure that all user inputs are properly sanitized and consider implementing prepared statements to prevent such injections in the future. You've got this! With these steps, you'll tighten up security and keep your application safe. 🛡️

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-16T08:12Z
EPSS history
Timeline
  • 16 DEC 08:12Z
    WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability
    cvelistv5