What is the CVSS score of EUVD-2026-15801?

EUVD-2026-15801 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bus Ticket Booking With Seat Reservation are affected by EUVD-2026-15801?

CVE-2026-27095 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate EUVD-2026-15801?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Bus Ticket Booking With Seat Reservation EUVD-2026-15801

| CVE-2026-27095 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-hxqh-gmmg-xpxf

Deserialization Bus Ticket Booking With Seat Reservation

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15801

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.

AnalysisAI

A deserialization of untrusted data vulnerability (CWE-502) exists in the magepeopleteam Bus Ticket Booking with Seat Reservation WordPress plugin through version 5.6.0, allowing object injection attacks. An attacker can inject malicious serialized PHP objects into the application, potentially leading to remote code execution or other critical impacts depending on available gadget chains in the WordPress environment. No CVSS score or EPSS data is currently available, and KEV status is unknown, but the vulnerability affects all installations running the vulnerable plugin versions.

Technical ContextAI

This vulnerability is rooted in unsafe PHP object deserialization (CWE-502), where user-supplied data is passed directly to PHP's unserialize() function without validation or integrity checks. The Bus Ticket Booking with Seat Reservation plugin (CPE: cpe:2.3:a:magepeopleteam:bus_ticket_booking_with_seat_reservation:*:*:*:*:*:*:*:*) implements insecure deserialization logic that permits attackers to craft malicious serialized objects. In a WordPress context, this is particularly dangerous because the WordPress ecosystem contains numerous gadget chains in popular plugins and themes that can be chained together to achieve remote code execution once an attacker can control object instantiation and method invocation.

RemediationAI

Immediately upgrade the Bus Ticket Booking with Seat Reservation plugin to version 5.6.2 or later, which addresses the PHP object injection vulnerability. Check the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/bus-ticket-booking-with-seat-reservation/vulnerability/wordpress-bus-ticket-booking-with-seat-reservation-plugin-5-6-2-php-object-injection-vulnerability) and the magepeopleteam plugin repository for the patched release. As an interim measure prior to patching, consider disabling the plugin if it is not critical to operations, or restrict access to WordPress administration and any exposed plugin endpoints using Web Application Firewall rules or IP whitelisting. Additionally, review WordPress error logs and application logs for evidence of serialized object injection attempts (patterns like O:number or unusual base64 content in requests).