CVE-2025-66105: Bus Ticket Booking Auth Bypass Flaw

CVE-2025-66105 Overview

CVE-2025-66105 is a Missing Authorization vulnerability in the Magepeople Bus Ticket Booking with Seat Reservation plugin for WordPress. The flaw stems from incorrectly configured access control security levels [CWE-862]. It affects all versions of the plugin from n/a up to and including 5.6.8.

The issue allows unauthenticated network attackers to reach functionality that should be restricted. Successful exploitation can lead to limited integrity impact on affected sites without requiring user interaction or privileges.

Critical Impact
Unauthenticated attackers can interact with restricted plugin functionality due to broken access control, potentially modifying booking-related data on affected WordPress sites.

Affected Products

Magepeople Bus Ticket Booking with Seat Reservation plugin for WordPress
All versions prior to and including 5.6.8
WordPress installations running the vulnerable plugin

Discovery Timeline

2026-05-07 - CVE-2025-66105 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2025-66105

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under [CWE-862]. The Bus Ticket Booking with Seat Reservation plugin exposes one or more action handlers that fail to verify the requester's permissions before executing privileged operations. WordPress plugins typically rely on current_user_can() capability checks and nonce validation through check_ajax_referer() to gate sensitive endpoints. When these checks are missing or improperly configured, any visitor can invoke the underlying functionality.

The attack requires no authentication, no user interaction, and only network access to the target WordPress site. The impact is limited to integrity, meaning attackers can modify or write data without being able to read sensitive information or disrupt site availability through this flaw alone.

Root Cause

The root cause is incorrectly configured access control on plugin functionality. Action handlers, AJAX endpoints, or REST routes registered by the plugin omit proper capability checks. Without authorization enforcement, the WordPress AJAX layer or REST API forwards anonymous requests directly to logic that should be reserved for authenticated administrators or booking operators.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. The requests target plugin endpoints such as admin-ajax.php actions or REST API routes registered by the plugin. Because no authorization check rejects the request, the server executes the action and applies its intended state changes. Refer to the Patchstack Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2025-66105

Indicators of Compromise

Unexpected modifications to bus booking, seat reservation, or schedule records in the WordPress database
Anonymous POST requests to admin-ajax.php with action parameters belonging to the Bus Ticket Booking plugin
Unusual entries in WordPress access logs from external IPs targeting plugin REST routes

Detection Strategies

Inventory WordPress installations and identify any running the Bus Ticket Booking with Seat Reservation plugin at version 5.6.8 or earlier
Review web server access logs for unauthenticated requests to plugin AJAX or REST endpoints
Compare current plugin data against trusted backups to identify unauthorized changes

Monitoring Recommendations

Enable WordPress audit logging to capture plugin-level actions and user context
Alert on high-volume requests to admin-ajax.php originating from unauthenticated sessions
Monitor for newly created or modified booking records outside normal business workflows

How to Mitigate CVE-2025-66105

Immediate Actions Required

Update the Bus Ticket Booking with Seat Reservation plugin to a version later than 5.6.8 once released by Magepeople
Audit booking and reservation data for unauthorized changes since the plugin was installed
Restrict access to the WordPress site using a Web Application Firewall (WAF) with rules covering broken access control patterns

Patch Information

The vendor advisory tracked through Patchstack indicates the issue affects versions before the next release after 5.6.8. Site administrators should consult the Patchstack Vulnerability Report and the official plugin page for the fixed version and apply the update across all WordPress instances.

Workarounds

Deactivate the Bus Ticket Booking with Seat Reservation plugin until a patched version is installed
Block external access to the plugin's AJAX actions and REST routes at the WAF or reverse proxy layer
Limit access to the WordPress site to authenticated users using IP allowlists where booking is internal-only

bash

# Example WAF rule pattern blocking anonymous calls to plugin AJAX actions
# Replace <plugin_action_prefix> with the actual action name from the plugin
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1066105,msg:'Block unauthenticated Bus Ticket Booking plugin action'"
  SecRule ARGS:action "@beginsWith <plugin_action_prefix>" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"