---
id: "CVE-2026-112824"
kind: "vulnerability"
aliases: ["CVE-2026-112824"]
title: "Bus Ticket Booking WordPress plugin: missing authorization check through 5.9.7"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bus-ticket-booking-with-seat-reservation", "magepeople", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-20T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112824", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Bus Ticket Booking WordPress plugin: missing authorization check through 5.9.7

The Bus Ticket Booking with Seat Reservation WordPress plugin from Magepeople has a missing authorization check, so access control is not enforced on some actions. The sources do not say exactly which actions an attacker could reach or what data they could read or change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the plugin `bus-ticket-booking-with-seat-reservation` in the WordPress admin plugin list or `wp plugin get bus-ticket-booking-with-seat-reservation --field=version`
- Compare the version against `5.9.7`; the description says versions through 5.9.7 are affected

## Fix

- Update the plugin `bus-ticket-booking-with-seat-reservation` to a version later than `5.9.7`, as published by the vendor (fixed version unknown)

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112824

## From the sources

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_