CVE-2026-93928 in Taxi Booking Manager Plugin
Summary
by MITRE • 09/22/2026
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.
This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The identified security flaw represents a critical authentication bypass within the Taxi Booking Manager plugin for WordPress, specifically affecting versions prior to release 2.0.8. This vulnerability falls under the category of Authentication Bypass Using an Alternate Path or Channel, which is formally classified as CWE-287 in the Common Weakness Enumeration standard. The core technical issue stems from a failure in the application logic to consistently enforce authentication requirements across all entry points and administrative functions exposed by the plugin. In many WordPress plugins, developers may secure certain endpoints while inadvertently leaving others accessible without proper verification of user credentials or capabilities. This inconsistency creates an alternate path through which unauthenticated actors can interact with sensitive system functionalities that are intended to be restricted to authorized administrators only.
From a technical perspective, this vulnerability allows attackers who do not possess valid login credentials to execute administrative actions within the Taxi Booking Manager environment. By targeting these unprotected endpoints, malicious users can manipulate booking data, view confidential customer information, alter pricing structures, or potentially escalate privileges depending on how the plugin handles state changes and database updates via HTTP requests. The absence of a robust session validation check at these specific channels means that standard WordPress nonces or capability checks are either missing or improperly implemented for certain API endpoints or AJAX handlers exposed by the software. This lack of uniform security enforcement is a common architectural weakness in plugins where rapid development leads to inconsistent application of security controls across different modules.
The operational impact of this vulnerability is severe, particularly given the nature of taxi booking services which handle sensitive personal data and financial transactions. An attacker could exploit this flaw to gain unauthorized access to the backend management interface without needing to brute-force passwords or compromise existing user accounts. This direct bypass significantly lowers the barrier for entry, allowing even low-skilled threat actors to perform malicious actions such as deleting bookings, modifying driver assignments, or extracting customer contact details and payment information stored in the WordPress database. The integrity of the booking system is compromised, leading to potential financial loss for business owners and a significant breach of privacy for customers whose data is processed through this platform.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts or Default Accounts if default credentials are involved, but more accurately reflects the broader concept of bypassing authentication mechanisms to gain initial access. The exploitation typically involves crafting specific HTTP requests that target the unprotected endpoints identified in the plugin code. Since WordPress plugins often rely on AJAX handlers for dynamic content updates, these handlers must be rigorously audited to ensure they verify user roles and capabilities before processing any data modification or sensitive information retrieval. Failure to do so creates a direct pathway for unauthorized manipulation of application state.
To mitigate this risk, immediate action is required by updating the Taxi Booking Manager plugin to version 2.0.8 or later, where these authentication checks have been corrected. For organizations unable to update immediately due to compatibility constraints with other plugins or themes, temporary mitigation strategies should be implemented at the web server level. This can include restricting access to known vulnerable endpoints using IP whitelisting if they are only accessed from specific internal networks, or implementing Web Application Firewall rules that detect and block anomalous requests targeting these unprotected paths. Additionally, a thorough code audit of all AJAX handlers and REST API endpoints within the plugin is recommended to ensure consistent application of WordPress capability checks such as current_user_can across all administrative functions. Regular security assessments and adherence to secure coding practices that mandate authentication verification for every state-changing operation are essential to prevent similar vulnerabilities in future updates or other plugins used by the organization.