CVE-2026-97251: WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability
Published Oct 1, 2026
·Updated
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
Affected Software
1 affected component
WordPress Bus Ticket Booking with Seat Reservation<=5.9.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Bus Ticket Booking with Seat Reservation pluginto a version that resolves this vulnerability.Fixed in 5.9.4
Event History
Oct 1, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. It is remotely exploitable over the network.
2
Which plugin versions are affected?
Bus Ticket Booking with Seat Reservation versions up to and including 5.9.3 are affected.
3
What impact could successful exploitation have?
The reported CVSS vector indicates low impact to integrity and availability, with no reported confidentiality impact. The issue is categorized as an insecure direct object reference.