CVE-2026-107425
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Bus Ticket Booking with Seat Reservation plugin (Magepeople inc.) in versions up to 5.9.7 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker may perform unauthorized actions, such as accessing booking functions or modifying data, potentially disrupting the reservation system.
Recommendation
Update the Bus Ticket Booking with Seat Reservation plugin to a version later than 5.9.7 once a fix is available, and review user permissions.
Other vulnerabilities in Bus Ticket Booking with Seat Reservation
See all- CVE-2026-97251Medium
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.
- CVE-2025-66105Medium
Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.
- CVE-2026-39572Medium
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS