Is CVE-2026-97251 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97251 being exploited in the wild.

How severe is CVE-2026-97251?

Medium severity, with a CVSS score of 6.5, published 1 October 2026.

Which products and versions are affected?

Magepeople inc. Bus Ticket Booking with Seat Reservation versions 5.9.3 and earlier.

Is there a fix for CVE-2026-97251?

Yes: fixed in 5.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97251 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97251?

Check whether you run Magepeople inc. Bus Ticket Booking with Seat Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97251: Bus Ticket Booking with Seat Reservation insecure direct object references

CVE-2026-97251 · Severity: medium · CVSS 6.5 · Published 2026-10-01

A WordPress plugin for bus ticket booking and seat reservation allows attackers to access and manipulate other users' booking records without authentication. By modifying booking IDs in the URL, an attacker can view or modify another user's seat reservations, ticket details, or personal information associated with their booking.

Vendors: Magepeople inc..

Quick answers

Is CVE-2026-97251 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97251 being exploited in the wild.
How severe is CVE-2026-97251?: Medium severity, with a CVSS score of 6.5, published 1 October 2026.
Which products and versions are affected?: Magepeople inc. Bus Ticket Booking with Seat Reservation versions 5.9.3 and earlier.
Is there a fix for CVE-2026-97251?: Yes: fixed in 5.9.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97251 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97251?: Check whether you run Magepeople inc. Bus Ticket Booking with Seat Reservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.9.4

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the bus ticket booking plugin that allows unauthenticated attackers to enumerate and access arbitrary booking records by manipulating object identifiers in API requests or URL parameters. The affected component fails to enforce proper authorization checks on booking data retrieval and modification functions, enabling attackers to read or alter other users' reservations without credentials.

Affected products

Magepeople inc. Bus Ticket Booking with Seat Reservation versions 5.9.3 and earlier

Timeline

2026-10-01: disclosed
2026-08-31: other: Reported to developer

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.