E Cab Taxi Booking Manager For Woocommerce
Monthly
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.
Client-side price manipulation in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin (before 2.0.5) allows unauthenticated attackers to submit taxi booking orders at an arbitrary price, including zero, by supplying fabricated trip-distance and base-price values that the server accepts without validation. The plugin trusts the pricing parameters delivered in the booking request rather than computing cost authoritatively on the backend, constituting a classic business-logic bypass. A publicly available exploit exists per WPScan; no public exploitation tracking (KEV) is recorded, but the trivial exploitation requirements make this a meaningful financial risk for any operator running the affected plugin.