EUVD-2026-57931
GHSA-22pv-5hq3-v243
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable, unauthenticated endpoint with no interaction needed; integrity-only impact as booking data is modified but confidentiality and availability are unaffected.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
AnalysisAI
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Taxi Booking Manager for WooCommerce plugin (version <= 2.0.3) must be installed and active on a WordPress site running WooCommerce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High score is driven primarily by the PR:N/AC:L/UI:N combination - unauthenticated, low complexity, no interaction - paired with a High integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WooCommerce site running the vulnerable Taxi Booking Manager plugin and sends a crafted HTTP POST request directly to the unprotected WordPress AJAX or REST endpoint that lacks authorization checks. Without needing any session cookie, nonce, or credentials, the attacker triggers a privileged action - such as modifying booking records, changing pricing, or altering reservation statuses - achieving high integrity impact against the site's booking data. … |
| Remediation | Update the Taxi Booking Manager for WooCommerce plugin to a version beyond 2.0.3 via the WordPress admin dashboard (Plugins > Updates). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WooCommerce installations running Taxi Booking Manager plugin version 2.0.3 or earlier and document their criticality; if actively managing bookings, immediately disable the plugin pending remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables att
Unauthenticated broken access control in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (versions up to a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today