CVE-2026-84045 in E-cab Taxi Booking Manager for Woocommerce Plugin
Summary
by MITRE • 09/04/2026
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The E-cab Taxi Booking Manager for WooCommerce is a widely used plugin that enables WordPress-based websites to offer taxi or ride-hailing services directly through their online platforms. This functionality relies on calculating fares based on inputs provided by the user, such as pickup location, drop-off destination, and estimated trip distance. In versions prior to 2.0.5 of this plugin, a critical server-side validation flaw exists within the pricing logic mechanism. Specifically, the application fails to independently verify or sanitize client-supplied parameters related to trip distance and base price before using them to compute the final order total. This architectural oversight creates an opportunity for unauthenticated attackers to exploit the system by injecting manipulated values into the request payload sent during the booking process.
From a technical perspective, this vulnerability is classified as CWE-20: Improper Input Validation. The core issue lies in the assumption that data received from the client side is trustworthy and accurate without subsequent server-side confirmation. In secure software design principles, any user-supplied input used for financial calculations must be validated against known constraints or derived from trusted internal state rather than accepted at face value. By allowing arbitrary manipulation of distance and base price fields, the plugin effectively bypasses its own business logic controls. An attacker can craft a malicious HTTP request where these parameters are set to minimal or zero values while maintaining other aspects of the booking structure that appear legitimate to the system.
The operational impact of this vulnerability is severe from both financial and reputational standpoints. Because there is no server-side enforcement of minimum fare thresholds or realistic distance calculations, an unauthenticated attacker can force the order total down to zero. This allows them to place real taxi-booking orders without paying anything. Beyond direct revenue loss due to free rides being consumed by malicious actors, this exploitation undermines the integrity of the booking system. It may also lead to resource exhaustion if attackers flood the service with numerous zero-cost bookings, potentially disrupting operations for legitimate customers and increasing operational costs for drivers who are dispatched but not compensated appropriately depending on how the backend handles such anomalies.
In terms of threat modeling and industry frameworks, this vulnerability aligns closely with MITRE ATT&CK technique T1190: Exploit Public-Facing Application. The attacker leverages a publicly accessible web application feature to achieve unauthorized economic benefit. Furthermore, it reflects CWE-862: Missing Authorization in the context that while authentication is not required for exploitation, proper authorization of business rules and pricing logic is absent. This type of flaw is particularly dangerous because it does not require compromising user credentials or exploiting complex injection vectors; instead, it relies on simple parameter manipulation which can be automated easily using standard web tools.
To mitigate this vulnerability, immediate action should be taken to upgrade the E-cab Taxi Booking Manager plugin to version 2.0.5 or later, where these validation checks have been implemented. For organizations unable to update immediately due to compatibility constraints, temporary mitigations include implementing server-side rate limiting on booking endpoints to prevent rapid-fire requests and deploying a Web Application Firewall rule that monitors for anomalous pricing patterns such as zero-cost orders originating from new sessions. Additionally, developers should review the codebase to ensure all financial calculations are performed using data derived from trusted sources or validated against strict business rules before finalizing transactions. Regular security audits focusing on input validation in e-commerce and service-booking modules are essential to prevent similar flaws in future updates.