This vulnerability is a missing authorization flaw that permits attackers to bypass the intended access control policies of the Bus Ticket Booking with Seat Reservation plugin. By exploiting incorrectly configured security levels, an attacker can perform actions reserved for privileged users, such as modifying seat allocations and booking details, potentially disrupting event management and revenue. The weakness maps to CWE‑862, indicating a failure to enforce proper authorization checks.

Any WordPress site running the Bus Ticket Booking with Seat Reservation plugin prior to version 5.6.8, as provided by Magepeople Inc., is affected. Vendors and site administrators using earlier plugin releases should review their deployments.

The CVSS score of 5.3 places this issue in the medium severity band, illustrating that while the flaw does not grant remote code execution, it can significantly compromise data integrity and availability. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the lack of listing in CISA KEV suggests no documented active exploitation. The most likely attack vector is through the web application interface, where an attacker equipped with an account of insufficient privilege can access protected administration pages by manipulating URLs or form inputs.