Taxi Booking Manager For Woocommerce
Monthly
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this straightforward to exploit once the affected endpoint is identified.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Unauthenticated broken access control in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (versions up to and including 2.0.1) exposes limited information to remote attackers without requiring any credentials or user interaction. The plugin fails to enforce proper authorization checks on one or more endpoints, classified under CWE-862 (Missing Authorization), allowing unauthenticated network requests to access functionality or data that should be restricted. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.03%, indicating low observed exploitation probability at time of analysis.
Stored cross-site scripting (XSS) in Magepeople's Taxi Booking Manager for WooCommerce plugin (versions up to 2.0.0) allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of the application. No public exploit code or active exploitation has been confirmed at this time.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions <= 2.0.3) allows unauthenticated remote attackers to perform privileged actions without authorization, resulting in high integrity impact. The vulnerability stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling manipulation of booking data or plugin functionality without any credentials. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this straightforward to exploit once the affected endpoint is identified.
Broken access control in the Taxi Booking Manager for WooCommerce WordPress plugin (versions prior to 2.0.8) enables attackers to perform unauthorized write operations against booking data or plugin configuration, resulting in high integrity impact with no confidentiality or availability loss. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, a class of vulnerability common in WooCommerce plugins where AJAX handlers or REST routes omit WordPress capability checks. No public exploit code or active exploitation has been identified at time of analysis, and the plugin's niche deployment base limits overall exposure, though the low attack complexity means exploitation is straightforward once a vulnerable installation is located.
Unauthenticated broken access control in Magepeople Inc.'s Taxi Booking Manager for WooCommerce plugin (versions up to and including 2.0.1) exposes limited information to remote attackers without requiring any credentials or user interaction. The plugin fails to enforce proper authorization checks on one or more endpoints, classified under CWE-862 (Missing Authorization), allowing unauthenticated network requests to access functionality or data that should be restricted. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.03%, indicating low observed exploitation probability at time of analysis.
Stored cross-site scripting (XSS) in Magepeople's Taxi Booking Manager for WooCommerce plugin (versions up to 2.0.0) allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of the application. No public exploit code or active exploitation has been confirmed at this time.