Taxi Booking Manager EUVD-2026-31967

The vulnerability requires no special conditions - CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any WordPress installation running Taxi Booking Manager for WooCommerce version 2.0.1 or earlier. The plugin must be installed and active on the target WordPress/WooCommerce site. The scope is limited to confidentiality (C:L); integrity and availability are unaffected, meaning an attacker can read but not modify or delete data through this specific vector. Exploitation is limited in impact by the partial technical impact rating - the exact data exposed is not enumerated in available sources.

The CVSS base score of 5.3 (Medium) reflects a network-accessible, zero-complexity, unauthenticated attack with only partial confidentiality impact and no integrity or availability impact (C:L/I:N/A:N). EPSS at 0.03% (8th percentile) places this well below the threshold of observed exploitation activity, consistent with SSVC's 'Exploitation: none' determination. SSVC also flags the issue as 'Automatable: yes', meaning mass scanning and exploitation is technically feasible without human interaction - a meaningful widening factor even if current exploitation is absent. The net risk profile is: theoretically easy to automate at scale but limited to information disclosure and not yet being exploited. Organizations running large WooCommerce deployments with this plugin may be exposed to data enumeration, but the practical business impact depends on what specific data the unprotected endpoints return, which is not fully specified in available intelligence.

An attacker performs automated scanning across WordPress sites to identify installations of the Taxi Booking Manager plugin up to version 2.0.1, then issues unauthenticated HTTP requests to the plugin's unprotected endpoints, retrieving booking records, customer details, or other sensitive data without logging in. Because the attack requires no authentication and no user interaction, it is straightforward to script at scale. No public proof-of-concept code is identified at time of analysis, but the SSVC 'Automatable: yes' rating confirms automation is feasible.