Taxi Booking Manager CVE-2026-93928

Requires the target WordPress site to run the Taxi Booking Manager for WooCommerce plugin at a version before 2.0.8 (and, given it is a WooCommerce extension, WooCommerce active). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, unauthenticated, low-complexity, and needs no user interaction against a default install - the alternate path/channel bypasses the authentication check itself. The primary limiting factor is not access difficulty but impact scope: the all-LOW C/I/A triad indicates the bypass grants only bounded access to protected plugin functionality rather than full administrative control. The exact vulnerable endpoint/feature is not specified in available data.

This is a genuine unauthenticated authentication-bypass flaw, but its real-world priority is moderate rather than critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3) is internally consistent and aligns with CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the attacker reaches protected functionality over the network with no privileges, no user interaction, and low complexity. However, the impact metrics are all LOW (C:L/I:L/A:L), which tells the real story - bypassing authentication here yields bounded access to protected functionality rather than full site or admin takeover, so the CVSS is inflated by the ease-of-access metrics more than by consequence. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active exploitation or automated weaponization. Only a single Patchstack advisory backs the finding; no SSVC decision-framework data (exploitation/automatable/technical-impact) was supplied. Net: treat as a should-patch (patch is available in 2.0.8), not a drop-everything emergency, and note the low product footprint further reduces aggregate risk.

A remote unauthenticated attacker crafts a request to the plugin using an alternate path or channel that skips the normal authentication check, gaining access to protected Taxi Booking Manager functionality on a WooCommerce site running a version before 2.0.8. Because the CVSS is PR:N/UI:N/AC:L, no credentials, victim interaction, or special tooling are required. No public exploit code was identified in the provided data, so exploitation would currently require the attacker to independently reconstruct the alternate access path.