EUVD-2026-15801
GHSA-hxqh-gmmg-xpxf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
AnalysisAI
A deserialization of untrusted data vulnerability (CWE-502) exists in the magepeopleteam Bus Ticket Booking with Seat Reservation WordPress plugin through version 5.6.0, allowing object injection attacks. An attacker can inject malicious serialized PHP objects into the application, potentially leading to remote code execution or other critical impacts depending on available gadget chains in the WordPress environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit magepeopleteam Bus Ticket Booking with Seat Reservation plugin versions <= 5.6.0 via unsafe deserialization of untrusted data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk assessment is constrained by missing CVSS and EPSS data, limiting quantitative exploitation probability estimates. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker could craft a malicious HTTP request containing a specially crafted serialized PHP object targeting an exposed plugin endpoint (such as a REST API endpoint, AJAX handler, or form parameter). Upon deserialization by the vulnerable plugin code, the injected object would instantiate malicious gadget chains from the WordPress environment—for example, chaining through WP-CLI or plugin-provided classes to execute arbitrary code with the privileges of the web server user. … |
| Remediation | Immediately upgrade the Bus Ticket Booking with Seat Reservation plugin to version 5.6.2 or later, which addresses the PHP object injection vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today