Bus Ticket Booking with Seat Reservation < 5.9.5 - Missing Authorization to Booking Billing Details Modification via wbtm_standalone_checkout_pay AJAX Action
- ID
- WPSEC-2026-0138
- Plugin
- Bus Ticket Booking with Seat Reservation (bus-ticket-booking-with-seat-reservation)
- Affected
- from 5.9.1 before 5.9.5
- Remediation
- Update to 5.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Bus Ticket Booking with Seat Reservation on WPSec AttackSurface
- Fix released
- Published
Description
The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to unauthorized modification of data in versions 5.9.1 to 5.9.3 (released through the wordpress.org trunk) due to an insufficient ownership check in the ajax_checkout_pay() function of the bundled standalone booking engine. The function checked the booking's paid status and the creator's access token on the record ID supplied in the request instead of on the booking group's head record, and secondary records of a multi-seat or round-trip booking carry no token, so the check fell through to the legacy allowance. This makes it possible for unauthenticated attackers, using the guest checkout nonce shown on public pages, to overwrite the billing name, email address and phone number of another customer's booking group and send it through the offline checkout, after which the guest ticket portal (booking ID plus email) could expose that booking. Version 5.9.0 is not affected (the standalone engine was only in the Pro add-on); the fix shipped in 5.9.4.
References
- https://wpsec.com/vuln/WPSEC-2026-0138/
- https://plugins.svn.wordpress.org/bus-ticket-booking-with-seat-reservation/tags/5.9.5/
- https://wordpress.org/plugins/bus-ticket-booking-with-seat-reservation/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS