CVE-2026-112824: WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates network access is sufficient. It requires no privileges and no user interaction, with low attack complexity.

Q: What is the expected security impact?

The reported impact is limited to integrity, rated low. No confidentiality or availability impact is indicated.

Published Oct 20, 2026

Updated

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

Affected Software

1 affected component

MagePeople Bus Ticket Booking with Seat Reservation<=5.9.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Bus Ticket Booking with Seat Reservation plugin to a version that resolves this vulnerability.
Fixed in 5.9.8

Event History

Oct 20, 2026

CVE Published

via MITRE·03:13 PM

Data Sourced

via MITRE·03:13 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates network access is sufficient. It requires no privileges and no user interaction, with low attack complexity.

What is the expected security impact?