Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Booking Billing Details Modification
- ID
- WPSEC-2026-2468
- Plugin
- Bus Ticket Booking with Seat Reservation (bus-ticket-booking-with-seat-reservation)
- Affected
- from 5.9.1 before 5.9.9
- Remediation
- Update to 5.9.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Bus Ticket Booking with Seat Reservation on WPSec AttackSurface
- Fix released
- Published
Description
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.9.1 up to, and including, 5.9.8. The 5.9.4 and 5.9.5 fixes protect new standalone bookings with an access token, but the standalone checkout still accepts unpaid bookings that have no token, such as bookings created through WooCommerce and standalone bookings made before 5.9.4. This makes it possible for unauthenticated attackers to overwrite the billing name, email address and phone number of such bookings and mark them as awaiting offline payment, on sites with the Offline Payment method enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2468/
- https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/
- https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS