Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Pending Booking Deletion and Modification via 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' Parameters
- ID
- WPSEC-2026-1316
- Plugin
- Bus Ticket Booking with Seat Reservation (bus-ticket-booking-with-seat-reservation)
- Affected
- from 5.9.1 before 5.9.9
- Remediation
- Update to 5.9.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- Bus Ticket Booking with Seat Reservation on WPSec AttackSurface
- Fix released
- Published
Description
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' parameters of the standalone (Custom Payment) booking request (wbtm_ajax_add_to_cart) in all versions up to, and including, 5.9.8, due to a missing ownership check on the booking group named in the request: logged-out callers, and any caller for a guest booking, were treated as the group's owner. This makes it possible for unauthenticated attackers to permanently delete other customers' pending bookings and free their seats, or to remove the return leg of another customer's pending booking and attach their own seats to it.
References
- https://wpsec.com/vuln/WPSEC-2026-1316/
- https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/
- https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS