Bus Ticket Booking EUVD-2026-101016

Exploitation requires the Magepeople 'Bus Ticket Booking with Seat Reservation' plugin (version n/a through 5.9.7) to be installed and active on a WordPress site, and the attacker must reach the specific plugin endpoint/action that lacks a proper capability or authorization check. The CVSS vector indicates no special configuration and no user interaction; however, the exact vulnerable function, required privilege level, and whether any authenticated session is needed are not detailed in the provided description and should be confirmed from the Patchstack advisory. Impact is limited to partial integrity and availability (no confidentiality loss), which constrains realistic damage to manipulation or disruption of booking/reservation data rather than full site compromise.

This is a medium-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the Magepeople 'Bus Ticket Booking with Seat Reservation' WordPress plugin. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but limited impact (C:N/I:L/A:L - no confidentiality loss, partial integrity and availability impact). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The PR:N rating conflicts with the typical nature of broken-access-control bugs in WordPress plugins, which usually require at least a low-privilege authenticated session (e.g., subscriber); the Patchstack-assigned vector claims unauthenticated access, but the one-line description does not confirm whether any authentication is needed - this discrepancy should be verified against the Patchstack advisory. Overall this reads as a real but moderate-priority issue: a genuine access-control weakness with partial integrity/availability impact, not a critical widely-weaponized vulnerability, and tempered by the plugin's niche deployment footprint.

A remote attacker sends crafted requests directly to a plugin action or endpoint that fails to verify the caller's authorization, performing booking-management operations (e.g., modifying or canceling reservations/seat data) they should not be permitted to invoke. Per the CVSS vector this requires no user interaction and low attack complexity; the vector asserts no privileges, though broken-access-control flaws of this type often require a low-privilege account. No public exploit code was identified in the provided data.