CVE-2025-66105
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.
Risk Assessment
An attacker can gain access to administrative functions or data without proper permissions, potentially leading to data integrity compromise or unauthorized actions.
Recommendation
Update the Bus Ticket Booking with Seat Reservation plugin to version 5.6.8 or later, which fixes the missing authorization issue.
Other vulnerabilities in Bus Ticket Booking with Seat Reservation
See all- CVE-2026-97251Medium
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.
- CVE-2026-39572Medium
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bus Ticket Booking with Seat Reservation: from n/a before 5.6.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS