{"id":"CVE-2026-112824","kind":"vulnerability","aliases":["CVE-2026-112824"],"related":[],"title":"Bus Ticket Booking WordPress plugin: missing authorization check through 5.9.7","description":"Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.","summary":"The Bus Ticket Booking with Seat Reservation WordPress plugin from Magepeople has a missing authorization check, so access control is not enforced on some actions. The sources do not say exactly which actions an attacker could reach or what data they could read or change.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bus-ticket-booking-with-seat-reservation","magepeople","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin `bus-ticket-booking-with-seat-reservation` in the WordPress admin plugin list or `wp plugin get bus-ticket-booking-with-seat-reservation --field=version`\n- Compare the version against `5.9.7`; the description says versions through 5.9.7 are affected","fix":"- Update the plugin `bus-ticket-booking-with-seat-reservation` to a version later than `5.9.7`, as published by the vendor (fixed version unknown)","status":"open","published_at":"2026-10-20T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:45+00:00","updated_at":"2026-10-25T04:24:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:24:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the plugin `bus-ticket-booking-with-seat-reservation` to a version later than `5.9.7`, as published by the vendor (fixed version unknown)","reach":"unknown","title":"Bus Ticket Booking WordPress plugin: missing authorization check through 5.9.7","impact":"medium","summary":"The Bus Ticket Booking with Seat Reservation WordPress plugin from Magepeople has a missing authorization check, so access control is not enforced on some actions. The sources do not say exactly which actions an attacker could reach or what data they could read or change.","category":"package","nicknames":[],"who_cares":["wordpress","bus-ticket-booking-with-seat-reservation","magepeople"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources only say access control is misconfigured","analyst_note":"Find the vendor advisory or patched version and the specific vulnerable endpoint at https://nvd.nist.gov/vuln/detail/CVE-2026-112824.","how_to_check":"- Check the installed version of the plugin `bus-ticket-booking-with-seat-reservation` in the WordPress admin plugin list or `wp plugin get bus-ticket-booking-with-seat-reservation --field=version`\n- Compare the version against `5.9.7`; the description says versions through 5.9.7 are affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Bus Ticket Booking with Seat Reservation plugin at version 5.9.7 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say which roles or configurations make the flaw reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":3319,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112824':13A,16A '-2026':12A,15A '5.9.7':10A,110C 'access':44B,95C 'action':51B,59B 'affect':100C 'allow':91C 'attack':61B 'author':7A,41B,73C 'book':3A,20B,30B,80C,87C,103C 'bus':1A,18B,28B,78C,85C,101C 'bus-ticket-booking-with-seat-reserv':17B,84C 'chang':71B 'check':8A,42B 'configur':94C 'control':45B,96C 'could':62B,68B 'cve':11A,14A 'data':66B 'enforc':48B 'exact':57B 'exploit':92C 'inc':77C 'incorrect':93C 'issu':99C 'levels.this':98C 'magepeopl':24B,37B,76C 'miss':6A,40B,72C 'n/a':108C 'packag':25B 'plugin':5A,35B 'reach':63B 'read':69B 'reserv':23B,33B,83C,90C,106C 'say':56B 'seat':22B,32B,82C,89C,105C 'secur':97C 'sourc':53B 'ticket':2A,19B,29B,79C,86C,102C 'vulner':74C 'wordpress':4A,26B,34B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Bus Ticket Booking with Seat Reservation plugin at version 5.9.7 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say which roles or configurations make the flaw reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112824","severity":null,"published_at":"2026-10-20T16:17:03+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}