CVE-2025-68055

HIGH

Themefic Hydra Booking <1.1.32 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-68055. PoCs published by adminlove520, Nosiume.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-68055, an authenticated SQL injection vulnerability in the Hydra Booking WordPress plugin. The exploit demonstrates time-based blind SQL injection to dump user credentials and list users.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

Exploits (2)

github WORKING POC 2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-68055

This repository contains a functional Python exploit for CVE-2025-68055, an authenticated SQL injection vulnerability in the Hydra Booking WordPress plugin. The exploit demonstrates time-based blind SQL injection to dump user credentials and list users.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Hydra Booking WordPress Plugin <= 1.1.32
Auth required
Prerequisites: WordPress credentials · Hydra Booking plugin installed and activated
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Nosiume · poc
https://github.com/Nosiume/CVE-2025-68055-poc

This repository contains a functional Python exploit for CVE-2025-68055, an authenticated SQL injection vulnerability in the Hydra Booking WordPress plugin. The exploit demonstrates time-based blind SQLi to dump user credentials and verify vulnerability status.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Hydra Booking WordPress Plugin <= 1.1.32
Auth required
Prerequisites: Valid WordPress credentials · Hydra Booking plugin installed and vulnerable
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 8.5
EPSS 0.0029
EPSS Percentile 20.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
Themefic/Hydra Booking < 1.1.32
Themefic/Hydra Booking < <= 1.1.32
Published Dec 16, 2025
Tracked Since Feb 18, 2026