Deserialization of untrusted data in magepeopleteam’s Bus Ticket Booking with Seat Reservation plugin allows an attacker to inject a malicious PHP object. When the plugin processes the crafted payload, it may instantiate attacker‑controlled objects and execute arbitrary code, potentially giving full control over the WordPress site. This flaw is classified as a PHP Object Injection weakness (CWE-502).

All releases of the Bus Ticket Booking with Seat Reservation plugin up to and including version 5.6.0 are affected. No particular patch or version is listed in the CNA data, so any deployment on a vulnerable version must be considered at risk.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score is lower than 1%, suggesting a low current exploitation probability. The risk is not mitigated by a KEV listing. The likely attack vector is remote, via web requests that supply a tampered serialized payload to the plugin’s processing endpoint. Successful exploitation would allow an attacker to execute arbitrary code, compromising site integrity, confidentiality, and availability.