EUVD-2026-62383
GHSA-pfgw-q4gx-xgv3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description and tags explicitly state unauthenticated exploitation and authentication bypass, warranting PR:N; integrity-only impact with no confidentiality or availability effect confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
AnalysisAI
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Based on the CVSS vector (PR:L), exploitation requires a minimum of a low-privileged WordPress account such as a subscriber or WooCommerce customer role on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N = 6.5 Medium) indicates low attack complexity, network accessibility, and high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker - potentially unauthenticated, or holding only a low-privileged WordPress subscriber account given the CVSS PR:L discrepancy - sends a crafted HTTP POST request directly to an unprotected AJAX or REST endpoint exposed by the plugin, bypassing authorization because no capability check is performed server-side. This allows the attacker to modify, create, or delete taxi booking records, alter pricing or availability settings, or otherwise tamper with the WooCommerce booking workflow. … |
| Remediation | Update the Taxi Booking Manager for WooCommerce plugin to version 2.0.8 or later immediately via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or through WP-CLI with 'wp plugin update ecab-taxi-booking-manager'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenti
Unauthenticated broken access control in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (versions up to a
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today