What is the CVSS score of EUVD-2026-20221?

EUVD-2026-20221 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Bus Ticket Booking With Seat Reservation EUVD-2026-20221

| CVE-2026-39572 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-04-08 Patchstack

Information Disclosure Bus Ticket Booking With Seat Reservation

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 10:22 NVD

4.0 (MEDIUM) 4.3 (MEDIUM)

Analysis Generated

Apr 14, 2026 - 18:22 vuln.today

CVSS changed

Apr 14, 2026 - 18:22 NVD

4.0 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20221

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.

AnalysisAI

Sensitive system information exposure in magepeopleteam Bus Ticket Booking with Seat Reservation plugin (versions prior to 5.6.5) allows remote, unauthenticated attackers to retrieve embedded sensitive data via network access with high complexity exploitation. The vulnerability carries low real-world risk with EPSS score of 0.02% (5th percentile) and no confirmed active exploitation, though it may expose configuration details or internal system information to unauthorized parties.

Technical ContextAI

This vulnerability is rooted in CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), a class of weaknesses where sensitive data becomes accessible outside its intended trust boundary. The affected product is the Bus Ticket Booking with Seat Reservation plugin for WordPress (CPE: cpe:2.3:a:magepeopleteam:bus_ticket_booking_with_seat_reservation:*:*:*:*:*:*:*:*), which manages ticketing and seat reservation functionality. The vulnerability likely stems from insufficient access controls or improper data sanitization in API endpoints or plugin functionality that exposes internal system configurations, database metadata, or other sensitive attributes embedded in responses that should not be accessible to remote unauthenticated users.

RemediationAI

Update the Bus Ticket Booking with Seat Reservation plugin to version 5.6.5 or later, which includes the security fix addressing the sensitive data exposure. Users should navigate to their WordPress dashboard, go to Plugins > Installed Plugins, locate the Bus Ticket Booking with Seat Reservation plugin, and click Update if available. If automatic updates are not enabled, download version 5.6.5 or newer directly from the WordPress plugin repository or from the vendor's official distribution channel. No workarounds or mitigations are documented for this vulnerability; patching is the definitive remediation. See Patchstack's vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/bus-ticket-booking-with-seat-reservation/vulnerability/wordpress-bus-ticket-booking-with-seat-reservation-plugin-5-6-5-sensitive-data-exposure-vulnerability?_s_id=cve for additional details.