CVE-2026-73363 in Taxi Booking Manager Plugin
Summary
by MITRE • 08/19/2026
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as an unbroken access control issue within the Taxi Booking Manager plugin for WordPress, specifically affecting versions prior to 2.0.8, represents a critical failure in server-side authorization mechanisms. This flaw allows attackers who are not authenticated or lack sufficient privileges to perform actions that should be restricted to authorized administrators or verified users. In the context of web application security, broken access control is consistently ranked as one of the most severe risks because it directly undermines the fundamental principle of least privilege and data isolation. The vulnerability stems from insufficient validation of user permissions when processing requests related to taxi booking management functions, such as creating, modifying, or deleting bookings, managing driver assignments, or accessing sensitive configuration settings.
From a technical perspective, this flaw typically manifests through insecure direct object references or missing function-level access controls in the plugin's administrative endpoints. When an unauthenticated actor sends a crafted HTTP request to these endpoints, the application fails to verify whether the requester has the necessary role capabilities before executing the requested operation. This lack of enforcement means that any individual with knowledge of the endpoint URLs and required parameters can interact with sensitive backend logic as if they were an administrator. The absence of session validation or nonce verification in certain critical paths further exacerbates this risk, allowing for straightforward exploitation without the need for complex bypass techniques.
The operational impact of this vulnerability is significant due to the nature of taxi booking systems which often handle personally identifiable information and financial data. An attacker can exploit this flaw to manipulate booking records, potentially leading to service disruption by deleting active reservations or creating fraudulent bookings that consume resources. More critically, if the plugin stores sensitive customer details such as names, phone numbers, addresses, or payment information in accessible database tables linked to these endpoints, an unauthenticated user could exfiltrate this data through bulk export functions or direct API calls. This leads to a severe breach of confidentiality and integrity, violating regulatory compliance standards like GDPR or CCPA depending on the jurisdiction and customer base served by the website owner.
This vulnerability aligns with CWE-284, which describes Improper Access Control, where access control errors allow attackers to bypass intended restrictions. Furthermore, it maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts or Invalid Accounts depending on whether existing credentials are used, but more accurately fits within the broader category of unauthorized access leading to data exposure and system modification. The exploitation vector is typically remote via HTTP(S), requiring no prior authentication, which classifies it as a high-severity issue in most vulnerability scoring systems due to its ease of exploitation and broad impact potential across any WordPress site running this plugin version.
Mitigation strategies must prioritize immediate remediation by upgrading the Taxi Booking Manager for WooCommerce plugin to version 2.0.8 or later, where these access control checks have been implemented correctly. Developers should ensure that all administrative endpoints enforce strict role-based access controls using native WordPress capability checks such as current_user_can with appropriate capabilities like manage_options or edit_posts depending on the specific action. Additionally, implementing CSRF protection via nonces for state-changing requests and validating input parameters against expected formats can provide defense-in-depth layers. For sites unable to update immediately due to compatibility constraints, temporary mitigation may involve restricting access to wp-admin directories through IP whitelisting if feasible, though this is not a substitute for fixing the underlying code flaw. Regular security audits and penetration testing of custom plugins are essential to prevent similar authorization failures in future development cycles.