Bus Ticket Booking CVE-2026-112824

Exploitation requires a reachable instance of the Magepeople 'Bus Ticket Booking with Seat Reservation' WordPress plugin at version 5.9.7 or earlier, where an endpoint performs an action without properly enforcing an authorization/capability check. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and it is remotely reachable over the network against affected versions. The principal limiting factors are deployment scope - the site must run this specific, relatively niche booking plugin - and impact scope: only integrity is affected (I:L; C:N/A:N), so the attacker can alter certain data but cannot read confidential data or disrupt availability. No non-default configuration is indicated as a prerequisite in the available data.

This is a moderate-severity Missing Authorization flaw (CWE-862) with CVSS 5.3, and the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-reachable, low-complexity exploitation with no privileges or user interaction required (PR:N = unauthenticated), but impact is limited to integrity only (C:N/I:L/A:N) - meaning an attacker can alter some data but cannot read sensitive data or cause a denial of service. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public POC is indicated, so there is no public exploit identified at time of analysis. The combination of easy reachability but low, integrity-only impact places this as a real but non-urgent issue: worth patching in routine cycles rather than emergency response. Note a mild tension between the 'unauthenticated' CVSS vector and the real-world footprint - WordPress plugin broken-access-control issues are often mass-scanned by automated bots, so the low CVSS can understate opportunistic risk; conversely, the limited integrity-only impact caps the damage. EPSS is missing, so widespread-exploitation likelihood cannot be quantified from available data.

An unauthenticated remote attacker sends a crafted request to a vulnerable plugin endpoint that fails to verify authorization, allowing them to modify booking-related data (e.g., reservation records or seat/booking settings) they should not be able to change. No special privileges or user interaction are needed per the CVSS vector. No public exploit code is identified at time of analysis, but WordPress access-control flaws of this type are commonly targeted by automated scanners.