Access Control Misconfiguration in Magepeople's Bus Ticket Booking Product
CVE-2026-107425

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Bus Ticket Booking With Seat Reservation
Vendor
CVE Published:
14 October 2026

What is CVE-2026-107425?

A missing authorization vulnerability has been identified in the Bus Ticket Booking with Seat Reservation product by Magepeople. This security issue arises from incorrectly configured access control settings, which may allow unauthorized users to exploit the system. Users are encouraged to update their software to the latest version (5.9.8 or beyond) to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

Bus Ticket Booking with Seat Reservation 0 <= 5.9.7

References

https://patchstack.com/database/wordpress/plugin/bus-tick...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Tang | Patchstack Bug Bounty Program
.