Taxi Booking Manager WooCommerce CVE-2026-27345

The Taxi Booking Manager for WooCommerce plugin (version <= 2.0.3) must be installed and active on a WordPress site running WooCommerce. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication is required and no special configuration is needed beyond plugin installation - exploitation is possible against any default installation within the affected version range. What limits exploitation: the target site must have the specific plugin installed (niche deployment footprint), the attacker must identify the specific unprotected endpoint or action name (requires source code review or fuzzing), and the integrity impact is scoped to the plugin's own data (S:U - no scope change to other WordPress components or the underlying host).

The CVSS 7.5 High score is driven primarily by the PR:N/AC:L/UI:N combination - unauthenticated, low complexity, no interaction - paired with a High integrity impact. These metrics are internally consistent with the described broken access control. No EPSS data was provided in the intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, suggesting exploitation has not been observed at scale. However, the low exploitation bar (network-accessible, no credentials, standard HTTP request) means any attacker who identifies the unprotected endpoint can reliably exploit it - skill and automation requirements are minimal. The real-world risk is modulated by the plugin's limited deployment footprint: this is a niche taxi-booking add-on for WooCommerce, not a universal component. Organizations running e-commerce sites offering taxi or transport booking services on WooCommerce are the at-risk population and should treat this as a priority patch.

An unauthenticated attacker identifies a WooCommerce site running the vulnerable Taxi Booking Manager plugin and sends a crafted HTTP POST request directly to the unprotected WordPress AJAX or REST endpoint that lacks authorization checks. Without needing any session cookie, nonce, or credentials, the attacker triggers a privileged action - such as modifying booking records, changing pricing, or altering reservation statuses - achieving high integrity impact against the site's booking data. No public POC exists at time of analysis, but the attack requires only knowledge of the unprotected endpoint name, which is discoverable through plugin source code review.