The vulnerability is a missing authorization flaw that permits attackers to exploit incorrectly configured access control security levels in the Bus Ticket Booking with Seat Reservation plugin. This flaw can enable unauthorized access to restricted operations, potentially allowing creation, modification, or cancellation of ticket bookings, seat reservations, or viewing booking details. The impact is limited to the scope of the WordPress site that hosts the plugin, but it can lead to compromise of user data and service integrity.

Magepeople inc. Bus Ticket Booking with Seat Reservation plugin versions from the initial release through 5.9.7 are affected. Any WordPress installation that has this plugin installed on those versions is vulnerable. The risk applies to all users who rely on the plugin's seat reservation and booking functionalities within their site.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a low but non‑zero likelihood of exploitation in the current data set. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be remote through web requests to the plugin’s endpoints, and an attacker with network access to the WordPress site could send crafted requests to bypass authentication checks and access privileged functions.