CVE-2024-49294: Bus Ticket Booking CSRF Vulnerability

CVE-2024-49294 Overview

CVE-2024-49294 is a Cross-Site Request Forgery (CSRF) vulnerability in the MagePeople Team Bus Ticket Booking with Seat Reservation WordPress plugin. The flaw affects all versions from the initial release through 5.4.3. An attacker can trick an authenticated user into submitting a forged request that performs actions inside the plugin without the user's consent. The weakness is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction, typically visiting a malicious page or clicking a crafted link while authenticated to the WordPress site.

Critical Impact
Attackers can perform unauthorized state-changing actions in the plugin by abusing an authenticated victim's browser session, resulting in limited integrity impact on booking data.

Affected Products

MagePeople Team Bus Ticket Booking with Seat Reservation plugin for WordPress
All versions up to and including 5.4.3
WordPress sites using the bus-ticket-booking-with-seat-reservation plugin slug

Discovery Timeline

2025-01-07 - CVE-2024-49294 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49294

Vulnerability Analysis

The plugin exposes one or more state-changing HTTP endpoints that do not verify a valid anti-CSRF token before processing requests. WordPress provides the wp_nonce_field() and check_admin_referer() primitives to defend against this class of attack, but the affected endpoints in versions up to 5.4.3 fail to enforce them. As a result, requests originating from any third-party origin are accepted as long as the victim holds an active authenticated session on the target site.

Exploitation results in limited integrity impact with no confidentiality or availability consequences. The scope remains unchanged, meaning the attack executes with the privileges of the victim's account within the plugin context. The EPSS score of 0.183% reflects a low observed likelihood of exploitation attempts in the wild.

Root Cause

The root cause is missing or incorrect verification of request origin and token authenticity in one or more request handlers exposed by the bus-ticket-booking-with-seat-reservation plugin. Without wp_verify_nonce() checks or a comparable defense, the server cannot distinguish between legitimate user-initiated actions and cross-origin forged requests.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a malicious HTML page containing an auto-submitting form or hidden image tag that targets a vulnerable plugin endpoint. When an authenticated administrator or user visits the attacker-controlled page, the browser attaches the WordPress session cookie and issues the forged request. The plugin then processes the action as though the victim had initiated it.

Refer to the Patchstack advisory for coordinated disclosure details. No verified public proof-of-concept code has been released.

Detection Methods for CVE-2024-49294

Indicators of Compromise

Unexpected modifications to bus ticket bookings, seat reservations, or plugin configuration entries in the WordPress database
HTTP POST or GET requests to bus-ticket-booking-with-seat-reservation endpoints containing an external or missing Referer header
Requests to plugin action handlers without an accompanying _wpnonce parameter
Audit log entries showing administrative changes correlated with user visits to untrusted external URLs

Detection Strategies

Inspect web server access logs for cross-origin requests targeting plugin admin-ajax or admin-post endpoints associated with the plugin slug
Deploy a web application firewall rule that flags authenticated POST requests to WordPress admin endpoints lacking the _wpnonce parameter
Monitor WordPress activity logs for state changes not correlated with a legitimate admin session in the UI

Monitoring Recommendations

Enable a WordPress audit logging plugin to record all administrative actions with source IP and referrer metadata
Alert on outbound requests from administrator browsers to unfamiliar domains immediately preceding plugin configuration changes
Review installed plugin versions periodically and correlate with the Patchstack vulnerability database for known issues

How to Mitigate CVE-2024-49294

Immediate Actions Required

Update the bus-ticket-booking-with-seat-reservation plugin to a version later than 5.4.3 as soon as a patched release is available from MagePeople Team
Restrict administrative access to trusted networks using IP allowlisting at the reverse proxy or WAF layer
Require administrators to log out of the WordPress dashboard when not actively managing the site to minimize the CSRF exploitation window

Patch Information

At the time of NVD publication, the vendor advisory tracked by Patchstack lists all versions up to and including 5.4.3 as affected. Site owners should consult the Patchstack advisory for CVE-2024-49294 and the plugin's official WordPress.org page for the latest fixed version.

Workarounds

Deactivate and remove the plugin until a patched version is released if bus ticket booking functionality is not business critical
Deploy a WordPress-aware WAF ruleset that enforces Referer header validation and _wpnonce presence on plugin endpoints
Enforce SameSite=Lax or Strict cookies for the WordPress session cookie via server configuration to reduce cross-origin cookie transmission
Train administrators to avoid browsing untrusted sites in the same browser session used for WordPress administration

bash

# Example Nginx rule to block requests to the plugin lacking a same-origin Referer
location ~* /wp-admin/admin-(ajax|post)\.php {
    if ($http_referer !~* "^https?://your-site\.example/") {
        return 403;
    }
}