CVE-2026-97251
MediumCVSS 6.5Summary
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.
Risk Assessment
An attacker may access booking data or functions, potentially leading to data leakage or manipulation of reservations.
Recommendation
Update Bus Ticket Booking with Seat Reservation to the latest version and implement authorization checks for all object references.
Other vulnerabilities in Bus Ticket Booking with Seat Reservation
See all- CVE-2025-66105Medium
Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.
- CVE-2026-39572Medium
The Bus Ticket Booking with Seat Reservation plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Original NVD description (English source)
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS