CVE-2026-112824
MediumCVSS 5.3Summary
The WordPress Bus Ticket Booking with Seat Reservation plugin through 5.9.7 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.
Risk Assessment
An unauthorized user may gain access to functions or data they should not be permitted to use. The risk affects WordPress sites with the vulnerable plugin version installed.
Recommendation
Update the Bus Ticket Booking with Seat Reservation plugin to the latest version (above 5.9.7). Verify user permission configuration.
Other vulnerabilities in Bus Ticket Booking with Seat Reservation
See all- CVE-2026-107425Medium
The Bus Ticket Booking with Seat Reservation plugin (Magepeople inc.) in versions up to 5.9.7 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-97251Medium
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.
- CVE-2025-66105Medium
Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.
- CVE-2026-39572Medium
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS