# Bus Ticket Booking with Seat Reservation <= 5.9.8 - Unauthenticated Missing Authorization to Booking Billing Details Modification

- **ID:** WPSEC-2026-2468
- **Plugin:** Bus Ticket Booking with Seat Reservation (`bus-ticket-booking-with-seat-reservation`), https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/
- **Affected versions:** from 5.9.1 before 5.9.9
- **Fixed in:** 5.9.9 (Update to 5.9.9 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/bus-ticket-booking-with-seat-reservation
- **Fix released:** 2026-10-20
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2468/

## Description

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.9.1 up to, and including, 5.9.8. The 5.9.4 and 5.9.5 fixes protect new standalone bookings with an access token, but the standalone checkout still accepts unpaid bookings that have no token, such as bookings created through WooCommerce and standalone bookings made before 5.9.4. This makes it possible for unauthenticated attackers to overwrite the billing name, email address and phone number of such bookings and mark them as awaiting offline payment, on sites with the Offline Payment method enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2468/
- https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.9/
- https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2468/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.