# CVE-2026-39572: Magepeople Bus Ticket Booking sensitive data exposure

Source: https://junglewise.ai/threats/cve-2026-39572-magepeople-bus-ticket-booking-sensitive-data-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39572 · Severity: medium · CVSS 4.3 · Published 2026-04-08

The Bus Ticket Booking with Seat Reservation plugin for WordPress is vulnerable to a sensitive data exposure flaw. This plugin is used by websites to manage bus ticket sales and seat assignments. An exploit could allow an unauthorized individual to view internal system information or embedded data that should be restricted, potentially aiding in further attacks against the site.

Vendors: [MagePeople Team](https://junglewise.ai/threats/vendors/magepeople-team).

## Quick answers

**Is CVE-2026-39572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39572 being exploited in the wild.

**How severe is CVE-2026-39572?** Medium severity, with a CVSS score of 4.3, published 8 April 2026.

**Which products and versions are affected?** MagePeople Team Bus Ticket Booking with Seat Reservation up to 5.6.5.

**Is there a fix for CVE-2026-39572?** A patch was published on 2026-05-06: Fixed in version 5.6.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39572 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39572?** Check whether you run MagePeople Team Bus Ticket Booking with Seat Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Bus Ticket Booking with Seat Reservation plugin for WordPress (versions prior to 5.6.5) contains an 'Exposure of Sensitive System Information to an Unauthorized Control Sphere' vulnerability (CWE-497). The flaw allows for the retrieval of embedded sensitive data that is normally restricted from standard users. According to the CVSS vector, the attack can be carried out over the network with low complexity, though it may require low-level authenticated privileges. An attacker can leverage this information to gain insights into the system's internal configuration or data structures. The issue is resolved in version 5.6.5.

## Affected products

- magepeopleteam Bus Ticket Booking with Seat Reservation up to 5.6.5

## Timeline

- 2026-02-20: disclosed: Vulnerability reported by Trương Hữu Phúc
- 2026-03-22: advisory: Patchstack published advisory
- 2026-04-08: advisory: NVD published CVE-2026-39572
- 2026-05-06: patched: Fixed in version 5.6.5

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/bus-ticket-booking-with-seat-reservation/vulnerability/wordpress-bus-ticket-booking-with-seat-reservation-plugin-5-6-5-sensitive-data-exposure-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/bus-ticket-booking-with-seat-reservation/vulnerability/wordpress-bus-ticket-booking-with-seat-reservation-plugin-5-6-5-sensitive-data-exposure-vulnerability?_s_id=cve)