CVE-2025-30839 Overview
CVE-2025-30839 is a Missing Authorization vulnerability [CWE-862] affecting the magepeopleteam Taxi Booking Manager for WooCommerce plugin (ecab-taxi-booking-manager) for WordPress. The flaw results from incorrectly configured access control security levels and impacts all versions up to and including 1.2.1. An unauthenticated remote attacker can reach protected plugin functionality over the network without user interaction. The issue is limited to integrity impact and does not directly disclose data or crash the site.
Critical Impact
Unauthenticated attackers can invoke plugin actions that should be restricted, allowing tampering with taxi booking data on affected WooCommerce stores.
Affected Products
- magepeopleteam Taxi Booking Manager for WooCommerce plugin, versions up to and including 1.2.1
- WordPress sites running WooCommerce with the ecab-taxi-booking-manager plugin installed
- Deployments using any version prior to a vendor-supplied fix above 1.2.1
Discovery Timeline
- 2025-03-27 - CVE-2025-30839 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30839
Vulnerability Analysis
The vulnerability is a broken access control issue in the Taxi Booking Manager for WooCommerce plugin. One or more plugin endpoints fail to verify that the caller has the required capability or nonce before executing sensitive operations. As a result, requests from unauthenticated actors are processed as if they were authorized. The vulnerability is classified under [CWE-862] Missing Authorization and falls within the Broken Access Control category. The EPSS model currently places exploitation likelihood in the lower range, and no public exploit or CISA KEV listing is associated with this CVE at the time of writing.
Root Cause
The plugin exposes action handlers, likely via WordPress AJAX (admin-ajax.php) or REST routes, without enforcing current_user_can() capability checks or validating wp_verify_nonce() tokens. Authentication and authorization checks that should gate booking-related operations are either missing or incorrectly configured. This mirrors a common WordPress plugin flaw where developers register callbacks under wp_ajax_nopriv_* hooks or public REST endpoints without an authorization callback.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker crafts HTTP POST or GET requests to the vulnerable plugin endpoint, supplying parameters that trigger the unprotected action. No credentials, plugin configuration knowledge, or user interaction are required. The vulnerability manifests in the plugin's action routing logic. See the Patchstack Vulnerability Report for further technical detail.
Detection Methods for CVE-2025-30839
Indicators of Compromise
- Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing plugin actions containing ecab or taxi_booking action names.
- Unexpected creations, modifications, or deletions of booking records in the WooCommerce database originating from external IPs without an authenticated session cookie.
- Access log entries showing repeated requests to plugin REST routes under /wp-json/ associated with the ecab-taxi-booking-manager namespace.
Detection Strategies
- Inventory WordPress sites and flag any instance of ecab-taxi-booking-manager at version 1.2.1 or lower.
- Correlate web server logs to identify requests to plugin endpoints without a valid wordpress_logged_in_* cookie or missing _wpnonce parameter.
- Deploy web application firewall rules to alert on plugin action names invoked without authentication headers.
Monitoring Recommendations
- Enable WordPress audit logging to record booking record changes with the acting user identity, including anonymous requests.
- Monitor for spikes in traffic to admin-ajax.php originating from single IP addresses or hosting provider ranges.
- Review WooCommerce order and booking tables daily for entries not linked to a legitimate customer session.
How to Mitigate CVE-2025-30839
Immediate Actions Required
- Identify all WordPress sites running Taxi Booking Manager for WooCommerce version 1.2.1 or earlier and prioritize them for patching.
- Update the plugin to a version above 1.2.1 once the vendor releases a fixed release.
- Restrict administrative and AJAX endpoints behind IP allowlists or authentication proxies where feasible.
Patch Information
At the time of publication, the advisory indicates the issue affects versions n/a through <= 1.2.1. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org listing for the latest fixed version, and apply the update through the WordPress dashboard or wp-cli.
Workarounds
- Deactivate and remove the ecab-taxi-booking-manager plugin until a patched release is available.
- Deploy a WordPress-aware WAF rule that blocks unauthenticated requests to plugin action handlers.
- Enforce authentication on admin-ajax.php by disabling wp_ajax_nopriv_* handlers registered by the plugin through a custom mu-plugin.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate ecab-taxi-booking-manager --allow-root
wp plugin uninstall ecab-taxi-booking-manager --allow-root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
