The Themefic Hydra Booking plugin is vulnerable to an SQL injection attack that could allow authenticated users to compromise sensitive database information.

The plugin fails to properly sanitize user input before including it in SQL commands, resulting in a classic SQL injection flaw (CWE-89). This vulnerability requires the attacker to have at least low-level authenticated access to the WordPress application to trigger the malicious query.

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL queries against the underlying database. This can lead to unauthorized data exfiltration, exposure of sensitive user information, or partial disruption of service. Given the CVSS score of 8.5, this is considered a high severity issue that requires immediate attention to prevent potential data breaches.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate or uninstall the Hydra Booking plugin until a security update is released by Themefic.

Proactive Monitoring: Review database error logs and access logs for suspicious query patterns or unexpected SQL syntax errors, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules designed to detect and block common SQL injection payloads targeted at WordPress plugins.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (Nosiume/CVE-2025-68055-poc).

Due to the high severity of this SQL injection vulnerability and the presence of a public proof-of-concept, users of the Hydra Booking plugin must treat this with extreme urgency. Please monitor the vendor website for the release of a patched version and apply it immediately upon availability. In the interim, removing the vulnerable software is the only guaranteed way to mitigate the risk of database compromise.