A critical SQL injection vulnerability in the Themefic Hydra Booking plugin allows authenticated attackers to compromise database integrity and access sensitive information.

This vulnerability is an SQL injection flaw (CWE-89) triggered by the improper neutralization of special elements in database queries. According to the CVSS vector (PR:L), this attack requires a low-privileged authenticated user to successfully execute arbitrary SQL commands against the backend database.

Successful exploitation of this flaw allows an attacker to bypass standard application logic to read or manipulate database content. Given the CVSS score of 8.5, this high-severity issue poses a significant risk to data confidentiality and application availability, potentially leading to unauthorized data exfiltration or service disruption.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or remove the Hydra Booking plugin until the vendor releases a secure update.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from known user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a layer of protection while awaiting a vendor-supplied fix.

Public Exploit Available: Unknown.

The high CVSS score of 8.5 underscores the severity of this SQL injection vulnerability. Security teams should treat this as a priority and ensure that the vulnerable plugin is either updated if a fix becomes available or removed from the environment to prevent potential data compromise.