{
 "id": "WPSEC-2026-1316",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1316/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1316/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1316/index.md",
 "title": "Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Pending Booking Deletion and Modification via 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' Parameters",
 "description": "The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' parameters of the standalone (Custom Payment) booking request (wbtm_ajax_add_to_cart) in all versions up to, and including, 5.9.8, due to a missing ownership check on the booking group named in the request: logged-out callers, and any caller for a guest booking, were treated as the group's owner. This makes it possible for unauthenticated attackers to permanently delete other customers' pending bookings and free their seats, or to remove the return leg of another customer's pending booking and attach their own seats to it.",
 "plugin": {
  "slug": "bus-ticket-booking-with-seat-reservation",
  "name": "Bus Ticket Booking with Seat Reservation",
  "full_name": "Bus Ticket Booking with Seat Reservation",
  "wordpress_org": "https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bus-ticket-booking-with-seat-reservation/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.9.1",
    "from_inclusive": true,
    "to": "5.9.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.9.1 before 5.9.9"
  ]
 },
 "introduced_in": "5.9.1",
 "fixed_in": "5.9.9",
 "remediation": "Update to 5.9.9 or later.",
 "fix_released": "2026-10-20T04:36:53+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:35:59.537125+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1316/",
  "https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/",
  "https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}