{
 "id": "WPSEC-2026-2468",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2468/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2468/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2468/index.md",
 "title": "Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Booking Billing Details Modification",
 "description": "The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.9.1 up to, and including, 5.9.8. The 5.9.4 and 5.9.5 fixes protect new standalone bookings with an access token, but the standalone checkout still accepts unpaid bookings that have no token, such as bookings created through WooCommerce and standalone bookings made before 5.9.4. This makes it possible for unauthenticated attackers to overwrite the billing name, email address and phone number of such bookings and mark them as awaiting offline payment, on sites with the Offline Payment method enabled.",
 "plugin": {
  "slug": "bus-ticket-booking-with-seat-reservation",
  "name": "Bus Ticket Booking with Seat Reservation",
  "full_name": "Bus Ticket Booking with Seat Reservation",
  "wordpress_org": "https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/",
  "advisories_url": "https://wpsec.com/vuln/plugin/bus-ticket-booking-with-seat-reservation/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.9.1",
    "from_inclusive": true,
    "to": "5.9.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.9.1 before 5.9.9"
  ]
 },
 "introduced_in": "5.9.1",
 "fixed_in": "5.9.9",
 "remediation": "Update to 5.9.9 or later.",
 "fix_released": "2026-10-20T04:36:53+00:00",
 "published": "2026-11-04T13:56:15+00:00",
 "updated": "2026-11-04T13:07:01.441519+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2468/",
  "https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/",
  "https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}