The vulnerability is a missing authorization flaw in the Bus Ticket Booking with Seat Reservation plugin. An attacker can gain unauthorized access to privileged actions within the booking system, potentially viewing or modifying reservation data and seat assignments. The weakness is classified as CWE-862 and can compromise the confidentiality, integrity, and availability of booking information for users of the WordPress site.

The issue affects Magepeople inc.’s WordPress plugin Bus Ticket Booking with Seat Reservation, versions up to and including 5.9.7. No specific WordPress core version is mentioned, but any site using this plugin in that range is vulnerable.

The CVSS score of 5.3 places the flaw in the medium severity range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface of the plugin, requiring either an authenticated user with insufficient privileges or potentially unauthenticated access to certain endpoints. Because the flaw allows bypassing authorization checks, attackers may exploit it remotely by sending crafted HTTP requests. Given the moderate CVSS rating but lack of known exploits, the risk is considered medium, but the potential impact to booking data warrants prompt remediation.