Skip to main content

Taxi Booking Manager EUVDEUVD-2026-92329

| CVE-2026-103351 MEDIUM
Improper Validation of Specified Quantity in Input (CWE-1284)
2026-10-05 Patchstack GHSA-hh49-m68v-pcf8
WordPress Information Disclosure Woocommerce Wordpress Plugin Taxi Booking Manager For Woocommerce Magepeople Inc
5.3
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Remotely reachable plugin endpoint with no auth or interaction (AV:N/AC:L/PR:N/UI:N); improper quantity validation yields limited data tampering, so I:L with C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

3
Metadata Corrected
Oct 05, 2026 - 09:40 vuln.today
tag: Woocommerce added
Analysis Generated
Oct 05, 2026 - 09:37 vuln.today
CVE Published
Oct 05, 2026 - 08:58 cve.org
MEDIUM 5.3

DescriptionCVE.org

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1.

AnalysisAI

Input data manipulation in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (all versions through 2.1.1) lets unauthenticated remote attackers tamper with a quantity-style input field that the plugin fails to validate properly, with the impact limited to integrity of that constrained booking/order value (C:N/I:L/A:N). The flaw carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), meaning no authentication, user interaction, or special configuration is needed to reach the vulnerable code path on a default WordPress plus WooCommerce installation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target site must have the Magepeople Taxi Booking Manager for WooCommerce plugin (version n/a through 2.1.1) installed and active, running atop WordPress with WooCommerce. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a moderate-severity (CVSS 5.3) WordPress plugin flaw whose real-world priority is low-to-moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch was identified at time of analysis - the available intelligence contains no fixed version, GitHub commit, or patch reference beyond the Patchstack advisory, so affected sites should treat every release up to and including 2.1.1 as vulnerable and monitor https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/ plus the Magepeople plugin changelog for the first patched release before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2026-103378 MEDIUM POC
6.5 Oct 07

Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
CVE-2026-93509 MEDIUM POC
6.5 Oct 08

Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all
CVE-2025-9316 MEDIUM POC
6.9
CVE-2026-49777 CRITICAL POC
10.0
CVE-2022-37134 CRITICAL POC
9.8
CVE-2021-43267 CRITICAL POC
9.8
CVE-2025-65548 CRITICAL POC
9.1
CVE-2023-54337 CRITICAL POC
9.1
CVE-2025-5349 HIGH POC
8.8
CVE-2026-82750 HIGH POC
8.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-92329 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy