CVE-2025-66105: Bus Ticket Booking Auth Bypass Flaw

CVE-2025-66105 Overview

CVE-2025-66105 is a Missing Authorization vulnerability in the Magepeople Bus Ticket Booking with Seat Reservation plugin for WordPress. The flaw stems from incorrectly configured access control security levels [CWE-862]. It affects all versions of the plugin from n/a up to and including 5.6.8.

The issue allows unauthenticated network attackers to reach functionality that should be restricted. Successful exploitation can lead to limited integrity impact on affected sites without requiring user interaction or privileges.

Critical Impact

Unauthenticated attackers can interact with restricted plugin functionality due to broken access control, potentially modifying booking-related data on affected WordPress sites.

Affected Products

• Magepeople Bus Ticket Booking with Seat Reservation plugin for WordPress
• All versions prior to and including 5.6.8
• WordPress installations running the vulnerable plugin

Discovery Timeline

• 2026-05-07 - CVE-2025-66105 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2025-66105

Vulnerability Analysis

The vulnerability is classified as Missing Authorization under [CWE-862]. The Bus Ticket Booking with Seat Reservation plugin exposes one or more action handlers that fail to verify the requester's permissions before executing privileged operations. WordPress plugins typically rely on current_user_can() capability checks and nonce validation through check_ajax_referer() to gate sensitive endpoints. When these checks are missing or improperly configured, any visitor can invoke the underlying functionality.

The attack requires no authentication, no user interaction, and only network access to the target WordPress site. The impact is limited to integrity, meaning attackers can modify or write data without being able to read sensitive information or disrupt site availability through this flaw alone.

Root Cause

The root cause is incorrectly configured access control on plugin functionality. Action handlers, AJAX endpoints, or REST routes registered by the plugin omit proper capability checks. Without authorization enforcement, the WordPress AJAX layer or REST API forwards anonymous requests directly to logic that should be reserved for authenticated administrators or booking operators.

Attack Vector

An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. The requests target plugin endpoints such as admin-ajax.php actions or REST API routes registered by the plugin. Because no authorization check rejects the request, the server executes the action and applies its intended state changes. Refer to the Patchstack Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2025-66105

Indicators of Compromise

• Unexpected modifications to bus booking, seat reservation, or schedule records in the WordPress database
• Anonymous POST requests to admin-ajax.php with action parameters belonging to the Bus Ticket Booking plugin
• Unusual entries in WordPress access logs from external IPs targeting plugin REST routes

Detection Strategies

• Inventory WordPress installations and identify any running the Bus Ticket Booking with Seat Reservation plugin at version 5.6.8 or earlier
• Review web server access logs for unauthenticated requests to plugin AJAX or REST endpoints
• Compare current plugin data against trusted backups to identify unauthorized changes

Monitoring Recommendations

• Enable WordPress audit logging to capture plugin-level actions and user context
• Alert on high-volume requests to admin-ajax.php originating from unauthenticated sessions
• Monitor for newly created or modified booking records outside normal business workflows

How to Mitigate CVE-2025-66105

Immediate Actions Required

• Update the Bus Ticket Booking with Seat Reservation plugin to a version later than 5.6.8 once released by Magepeople
• Audit booking and reservation data for unauthorized changes since the plugin was installed
• Restrict access to the WordPress site using a Web Application Firewall (WAF) with rules covering broken access control patterns

Patch Information

The vendor advisory tracked through Patchstack indicates the issue affects versions before the next release after 5.6.8. Site administrators should consult the Patchstack Vulnerability Report and the official plugin page for the fixed version and apply the update across all WordPress instances.

Workarounds

• Deactivate the Bus Ticket Booking with Seat Reservation plugin until a patched version is installed
• Block external access to the plugin's AJAX actions and REST routes at the WAF or reverse proxy layer
• Limit access to the WordPress site to authenticated users using IP allowlists where booking is internal-only

# Example WAF rule pattern blocking anonymous calls to plugin AJAX actions
# Replace <plugin_action_prefix> with the actual action name from the plugin
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1066105,msg:'Block unauthenticated Bus Ticket Booking plugin action'"
  SecRule ARGS:action "@beginsWith <plugin_action_prefix>" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"