# Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Pending Booking Deletion and Modification via 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' Parameters

- **ID:** WPSEC-2026-1316
- **Plugin:** Bus Ticket Booking with Seat Reservation (`bus-ticket-booking-with-seat-reservation`), https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/
- **Affected versions:** from 5.9.1 before 5.9.9
- **Fixed in:** 5.9.9 (Update to 5.9.9 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1316/

## Description

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'wbtm_prev_outbound_group_id' and 'wbtm_return_group_id' parameters of the standalone (Custom Payment) booking request (wbtm_ajax_add_to_cart) in all versions up to, and including, 5.9.8, due to a missing ownership check on the booking group named in the request: logged-out callers, and any caller for a guest booking, were treated as the group's owner. This makes it possible for unauthenticated attackers to permanently delete other customers' pending bookings and free their seats, or to remove the return leg of another customer's pending booking and attach their own seats to it.

## References

- https://wpsec.com/vuln/WPSEC-2026-1316/
- https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/
- https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1316/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.