Missing Authorization Flaw in Magepeople Bus Ticket Booking Product
CVE-2026-112824

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Bus Ticket Booking With Seat Reservation
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112824?

A missing authorization vulnerability exists in the Bus Ticket Booking with Seat Reservation product by Magepeople. This issue is due to improperly configured access control security levels, which can allow unauthorized users to exploit the system and gain access to functionalities that should be restricted. The vulnerability affects versions from release n/a up to 5.9.7, highlighting the need for timely updates and stringent access control protocols to mitigate security risks.

Affected Version(s)

Bus Ticket Booking with Seat Reservation 0 <= 5.9.7

References

https://patchstack.com/database/wordpress/plugin/bus-tick...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala | Patchstack Bug Bounty Program
.