Description

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T11:17:19.213Z",
  "pubdate": "2026-09-04T11:17:19.213Z",
  "executiveSummary": "The E-cab Taxi Booking Manager for Woocommerce WordPress plugin prior to version 2.0.5 is susceptible to an insecure server-side input validation vulnerability. This flaw allows unauthenticated attackers to conduct price manipulation attacks during the booking process.\nBy intercepting and modifying client-supplied parameters such as trip distance and base-price values before they are processed by the server, an attacker can override the calculated cost of a taxi booking. The vulnerability enables the manipulation of the order total to an arbitrary value, including zero.\nThis represents a significant business logic flaw, as it permits the unauthorized creation of service bookings without proper payment or at substantially reduced costs. The impact includes financial loss for the service provider, potential service abuse, and unauthorized resource allocation. The attack requires no authentication, making it reachable by any remote actor with access to the public booking interface. The risk is critical, as it bypasses standard e-commerce security controls implemented in the checkout flow of the affected WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability is the lack of server-side validation and sanitization for critical pricing parameters within the booking request lifecycle. In the affected versions of E-cab Taxi Booking Manager for Woocommerce, the plugin relies on client-side calculations or accepts externally provided values for trip distance and base price without re-verifying these figures against authorized pricing logic on the backend.\nThe attack vector involves a standard HTTP request manipulation. During the booking phase, the client application transmits pricing-related parameters to the server. An unauthenticated attacker can capture these requests using an intercepting proxy (such as Burp Suite or OWASP ZAP). Upon capturing the request, the attacker can modify the parameters defining the trip's cost—specifically the distance-based calculation variables and the base price definition.\nBecause the server-side component fails to enforce an authoritative calculation based on defined business rules (e.g., origin/destination lookup or fixed tariff tables), it processes the manipulated data as legitimate input. The backend then uses these malicious inputs to finalize the booking total. By setting these values to zero or nominal amounts, the attacker forces the system to generate a booking confirmation at a significantly manipulated price point.\nThe attack flow follows these steps: 1) The attacker initiates a legitimate booking session on the public-facing booking portal. 2) The attacker intercepts the POST/GET request responsible for calculating or submitting the order cost before the final transaction is committed. 3) The attacker modifies the 'trip distance' or 'base price' parameters within the request body/parameters to a desired, lower value. 4) The server processes the malicious payload, accepting the unauthorized price adjustment as the absolute truth. 5) The checkout process completes, resulting in a successfully placed booking at an manipulated price, effectively bypassing the plugin's intended pricing schema.\nThis vulnerability is particularly severe because it does not require administrative privileges or session hijacking; it is a direct consequence of trusting client-supplied data in a transaction-critical context. The plugin fails to maintain a 'server-is-the-source-of-truth' architecture, allowing the client-side interaction to dictate financial outcomes, leading to immediate impact on the integrity of the booking system and potential financial fraud."
}