Taxi Booking Manager CVE-2026-73363

Based on the CVSS vector (PR:L), exploitation requires a minimum of a low-privileged WordPress account such as a subscriber or WooCommerce customer role on the target site. However, the CVE description explicitly labels this 'Unauthenticated' and the Patchstack tags include 'Authentication Bypass,' which directly conflicts with PR:L - if the description is accurate, no account is required at all. This discrepancy is unresolved from available data and represents the single most important unknown for defenders. In either case, the target site must have WooCommerce active and the Taxi Booking Manager for WooCommerce plugin installed at a version prior to 2.0.8. There is no confidentiality or availability impact - exploitation is limited to write operations (integrity), so attackers cannot exfiltrate data via this vector alone. The scope is unchanged (S:U), meaning exploitation does not pivot to other WordPress components or the underlying server.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5 Medium) indicates low attack complexity, network accessibility, and high integrity impact. However, a significant discrepancy exists between the CVSS metric PR:L (Low Privileges Required) and the CVE description and Patchstack tags, which explicitly label this as 'Unauthenticated' and 'Authentication Bypass.' These are materially different threat models: if PR:L is correct, a WordPress subscriber or customer account is required; if the description is correct and the flaw is truly unauthenticated, the realistic CVSS score would be 7.5 High (PR:N). This conflict must be verified against the Patchstack advisory or vendor changelog. No CISA KEV listing and no POC code are present in the available data, placing exploitation probability in the speculative range. The plugin's niche market (taxi operators using WooCommerce) limits blast radius compared to general-purpose WordPress plugins, but any deployed instance running a pre-2.0.8 version should treat this as a meaningful integrity risk.

An attacker - potentially unauthenticated, or holding only a low-privileged WordPress subscriber account given the CVSS PR:L discrepancy - sends a crafted HTTP POST request directly to an unprotected AJAX or REST endpoint exposed by the plugin, bypassing authorization because no capability check is performed server-side. This allows the attacker to modify, create, or delete taxi booking records, alter pricing or availability settings, or otherwise tamper with the WooCommerce booking workflow. No public POC exists at time of analysis, but the low attack complexity means any attacker who identifies the specific unprotected action can exploit it with a basic HTTP client.