CVE-2026-107425 Magepeople inc. CVE debrief

Who should care

Defenders responsible for WordPress installations with the Bus Ticket Booking with Seat Reservation plugin should assess exposure and prioritize remediation efforts. This includes verifying plugin versions, reviewing access control configurations, and monitoring for potential unauthorized access attempts. The vulnerability could lead to unauthorized access or service disruption, emphasizing the need for prompt action.

Why it matters

CVE-2026-107425 is a MEDIUM severity vulnerability in the WordPress Bus Ticket Booking with Seat Reservation plugin. Defenders should verify plugin versions and review access control configurations to prevent potential unauthorized access and service disruption.

• Potential unauthorized access to sensitive data or functionality
• Possible disruption of service due to exploitation
• Need for verification of plugin version and access control configurations
• Potential for lateral movement within the network if exploited

Technical summary

The Bus Ticket Booking with Seat Reservation plugin for WordPress, versions up to 5.9.7, is vulnerable to a Missing Authorization issue. This allows for Exploiting Incorrectly Configured Access Control Security Levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 6.5 and a severity rating of MEDIUM. Defenders should prioritize verifying the version of the plugin and ensuring it is updated to a version beyond 5.9.7 if possible. They should also review access control configurations for the plugin and monitor for potential unauthorized access attempts.

Defensive priority

Defenders should prioritize verifying the version of the Bus Ticket Booking with Seat Reservation plugin and ensuring it is updated to a version beyond 5.9.7 if possible. They should also review access control configurations for the plugin.

Recommended defensive actions

• Verify the version of the Bus Ticket Booking with Seat Reservation plugin and update if necessary
• Review access control configurations for the plugin
• Monitor for potential unauthorized access attempts
• Perform a thorough review of the plugin's access control settings
• Check for any suspicious activity in the system logs
• Implement compensating controls for exposed systems while remediation is scheduled
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details about the vulnerability, including its CVSS score and affected versions. However, there is limited information on exploitation or specific impacts. Defenders should verify plugin versions, review access control configurations, and monitor for potential unauthorized access attempts. The source item provides details about the vulnerability, but there is limited information on exploitation or specific impacts. The CVE Program record and NVD detail page offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.