Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-22T09:17:05.940Z",
  "pubdate": "2026-09-22T09:17:05.940Z",
  "executiveSummary": "The Taxi Booking Manager for WooCommerce plugin is susceptible to an Authentication Bypass vulnerability categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel).\nThis security flaw allows unauthenticated, remote attackers to circumvent standard WordPress authentication mechanisms and gain unauthorized access to the application.\nThe vulnerability affects versions of the plugin prior to 2.0.8.\nSuccessful exploitation allows an attacker to assume the identity of a legitimate user, potentially gaining administrative control depending on the context of the bypass.\nThis poses a critical risk to site integrity, data confidentiality, and overall platform security, as unauthorized actors can manipulate booking data, access sensitive customer information, or perform elevated actions within the WooCommerce environment.\nNo specific user interaction is required for an attacker to initiate the exploit, making this a significant threat to vulnerable WordPress installations.",
  "technicalDetails": "The vulnerability originates from an insecure implementation of authentication logic within the Taxi Booking Manager for WooCommerce plugin. The flaw resides in how the plugin handles specific requests, allowing an attacker to utilize an alternate path or channel to bypass the standard WordPress 'wp_authenticate' or equivalent session validation flows.\nRoot Cause: The plugin logic fails to adequately verify the authenticity of requests when performing sensitive operations. By crafting a request that navigates around the plugin's security checks, an attacker can trick the application into believing that a valid session is present, or by directly invoking internal functions intended for authenticated users without requiring a legitimate session token or credential handshake.\nAttack Flow: An attacker sends a specially crafted HTTP request to the vulnerable endpoint associated with the Taxi Booking Manager. This request is designed to satisfy the plugin's conditional logic checks in a way that triggers an authenticated execution path. Because the plugin does not properly enforce global WordPress authentication constants or session hooks, the application state shifts to an 'authenticated' status for the duration of the request execution.\nExploitation: Exploitation typically involves identifying the specific parameter or request structure that the plugin checks for session validation. By manipulating the request—often through headers or specific URL parameters—the attacker bypasses the gatekeeping functions. Once the bypass is achieved, the attacker can execute authorized functions, such as modifying booking configurations, accessing customer databases, or manipulating plugin settings.\nImpact: The post-exploitation impact is severe. An attacker may escalate privileges if the bypass allows access to administrative functions, potentially leading to the injection of malicious code, unauthorized modification of site content, or exfiltration of sensitive booking data stored within the WooCommerce backend. The lack of proper validation on critical administrative hooks within the plugin facilitates this unauthorized privilege elevation.\nVulnerable Versions: All versions of Taxi Booking Manager for WooCommerce from n/a before 2.0.8 are confirmed to be vulnerable. The issue exists due to flawed architectural design in handling user identification and session state, necessitating a comprehensive security update to the affected code segments."
}