WordPress Plugin Vulnerabilities

Bus Ticket Booking with Seat Reservation < 5.9.4 - Unauthenticated Insecure Direct Object Reference

Description

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.3. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
bus-ticket-booking-with-seat-reservation
Fixed in 5.9.4

References

CVE
CVE-2026-97251
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/02cb377a-3208-4031-b81f-724218891eef

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Supakiad S.
Verified
No
WPVDB ID
629c4638-b814-4be6-a30f-a668920517a5

Timeline

Publicly Published
2026-10-01 (about 15 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-09 (about 8 days ago)

Other

Published
Title
Published
2025-01-09
Title
One to one user Chat by WPGuppy < 1.1.1 - Authorization Bypass
Published
2026-04-14
Title
Avada (Fusion) Builder < 3.15.2 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference
Published
2026-09-06
Title
Otter Blocks < 3.1.8 - Missing Authorization to Unauthenticated Purchase Verification Bypass
Published
2026-06-02
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
Published
2026-07-23
Title
Kirki < 6.1.0 - Unauthenticated Sensitive Data Disclosure via context Parameter