CVE-2026-39572
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Risk Assessment
An attacker can access confidential system information, potentially leading to further attacks or data leakage.
Recommendation
Update the Bus Ticket Booking with Seat Reservation plugin to version 5.6.5 or later.
Other vulnerabilities in Bus Ticket Booking with Seat Reservation
See all- CVE-2026-112824Medium
The WordPress Bus Ticket Booking with Seat Reservation plugin through 5.9.7 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.
- CVE-2026-107425Medium
The Bus Ticket Booking with Seat Reservation plugin (Magepeople inc.) in versions up to 5.9.7 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-97251Medium
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.
- CVE-2025-66105Medium
Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS