Description

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T13:18:07.390Z",
  "pubdate": "2026-08-19T13:18:07.390Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the Taxi Booking Manager for WooCommerce plugin affecting versions prior to 2.0.8. This security flaw exposes sensitive application functionality and administrative controls over the network without requiring any form of user authentication or session validation.\nThe primary impact of this vulnerability involves unauthorized access, potential data leakage, and unauthorized manipulation of booking management operations within affected WordPress installations. Threat actors with network access can bypass standard security perimeters and execute privileged actions intended exclusively for authorized roles.\nThe risk implication is critical, as successful exploitation requires no prior privileges or interaction from authenticated users, lowering the attack barrier significantly. The attack vector relies on direct HTTP requests targeting vulnerable endpoints within the plugin.\nRemediation requires upgrading the Taxi Booking Manager for WooCommerce plugin to version 2.0.8 or later, where proper authorization checks are enforced.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control checks and missing capability validations within request handlers exposed by the Taxi Booking Manager for WooCommerce plugin. Specifically, critical functions responsible for processing management requests fail to verify whether the incoming HTTP request originates from an authenticated user possessing appropriate administrative or managerial privileges.\nThe vulnerable components reside within the backend routing and request handling architecture of the Taxi Booking Manager for WooCommerce < 2.0.8. Because the plugin fails to implement robust permission checks, unauthenticated external attackers can interact directly with sensitive backend functions over the network via standard HTTP methods (such as GET or POST).\nThe exploitation method relies on identifying and directly invoking the exposed functionality or AJAX endpoints. An attacker constructs crafted HTTP requests targeting these unsecured operational handlers. Since the vulnerable component lacks session verification and role-based access control (RBAC) validation, the application processes the incoming payload and executes the requested operations as if an authorized administrator initiated them.\nThe attack flow proceeds as follows: First, the attacker maps the exposed endpoints associated with the Taxi Booking Manager for WooCommerce. Second, the attacker crafts an unauthorized request containing specific parameters designed to interact with booking data or administrative routines. Third, the unauthenticated request is transmitted across the network to the target WordPress site. Fourth, the vulnerable plugin accepts the input, bypasses authorization logic due to absent capability checks, and executes the underlying function, resulting in unauthorized data exposure or state modification.\nPost-exploitation impact includes unauthorized modification of taxi bookings, potential extraction of sensitive customer transactional data, and operational disruption of the booking service. Network exposure is external, requiring only HTTP/HTTPS connectivity to the target WordPress site running the vulnerable software version."
}