Taxi Booking Manager EUVD-2026-112874

The target must be a WordPress/WooCommerce site running the Taxi Booking Manager for WooCommerce (ecab-taxi-booking-manager) plugin at version 2.1.6 or earlier with the plugin active. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special difficulty are required - the attacker reaches an endpoint whose authorization/access-control check is missing or misconfigured. The exact vulnerable feature or endpoint is not described in the available sources. The principal limiting factors are footprint (a niche booking plugin, not a default WordPress component) and impact scope: the CVSS vector caps the effect at a low integrity impact (C:N, A:N), so successful exploitation yields unauthorized action/data modification on plugin-managed functionality rather than data theft or site takedown.

This is a moderate, CVSS 5.3 Missing Authorization issue (CWE-862) in the Taxi Booking Manager for WooCommerce WordPress plugin, and the signals are consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is a limited integrity effect (C:N, A:N) - meaning an attacker can perform some unauthorized action or modify some data they should not, but cannot read sensitive data or disrupt availability through this flaw alone. Exploitation status is 'no public exploit identified at time of analysis': the single reference is the Patchstack advisory record, not verified working exploit code, and the CVE is not listed in CISA KEV. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. The vuln.today decision label is 'this_month', indicating a routine patch-cycle priority rather than an emergency. Overall this reads as a genuine but low-to-moderate access-control weakness in a niche plugin - worth remediating on a normal schedule, not a drop-everything incident. Note the limited impact: broken access control on a booking plugin typically exposes a specific endpoint/action rather than full site compromise.

A remote, unauthenticated attacker sends a crafted request directly to an access-control-deficient endpoint of the Taxi Booking Manager plugin (versions up to 2.1.6) on a WooCommerce site, invoking an action that should be restricted. Because authorization checks are missing, the request succeeds and allows unauthorized modification of plugin-managed data (integrity impact, I:L). No public, verified exploit code was identified in the provided sources; only the Patchstack advisory reference exists.