CVE-2026-73363: Taxi Booking Manager Auth Bypass Flaw

CVE-2026-73363 Overview

CVE-2026-73363 is a broken access control vulnerability affecting the Taxi Booking Manager for WooCommerce WordPress plugin in versions prior to 2.0.8. The flaw stems from missing authorization checks [CWE-862], allowing authenticated users with low privileges to perform actions that should be restricted. The vulnerability impacts data integrity within affected WordPress installations running the plugin.

Critical Impact
An authenticated attacker with low privileges can exploit missing authorization checks over the network to modify data within the Taxi Booking Manager for WooCommerce plugin, compromising booking integrity without user interaction.

Affected Products

Taxi Booking Manager for WooCommerce plugin for WordPress
Versions prior to 2.0.8
WordPress installations running the ecab-taxi-booking-manager plugin

Discovery Timeline

2026-08-19 - CVE CVE-2026-73363 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73363

Vulnerability Analysis

The Taxi Booking Manager for WooCommerce plugin fails to enforce authorization checks on sensitive functionality. An attacker holding a low-privileged authenticated session can invoke plugin actions reserved for higher-privileged roles. This weakness maps to CWE-862: Missing Authorization.

Successful exploitation impacts the integrity of booking data and related WooCommerce records. The vulnerability does not expose sensitive data or affect availability directly. However, unauthorized data modification can disrupt business operations and downstream transaction workflows.

The EPSS score sits at 0.174%, indicating low near-term exploitation probability, though the lack of authorization checks makes the vulnerability trivial to weaponize once discovered. No public proof-of-concept exploit is currently available.

Root Cause

The root cause is missing or insufficient authorization enforcement on plugin endpoints. The affected code paths do not verify that the requesting user holds the required WordPress capability before executing privileged operations. This is a classic broken access control pattern documented in the OWASP Top 10.

Attack Vector

Exploitation requires network access to the target WordPress instance and a valid low-privileged account, such as a subscriber or customer. The attacker sends crafted HTTP requests to vulnerable plugin endpoints. No user interaction is needed to complete the attack. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2026-73363

Indicators of Compromise

Unexpected modifications to taxi booking records, fares, or vehicle assignments in the WordPress database
HTTP requests from low-privileged authenticated accounts targeting admin-ajax.php or REST endpoints registered by the ecab-taxi-booking-manager plugin
WooCommerce order state changes that do not align with the originating customer account

Detection Strategies

Review web server access logs for authenticated requests to plugin action handlers by users lacking administrative roles
Correlate WordPress audit logs with WooCommerce transaction logs to identify unauthorized data changes
Deploy a WordPress security plugin or web application firewall with signatures for the Patchstack advisory covering this CVE

Monitoring Recommendations

Enable WordPress user activity logging and forward events to a centralized SIEM for correlation
Alert on privilege-boundary violations where non-admin users invoke administrative plugin actions
Monitor for anomalous spikes in POST requests to the plugin's endpoints from subscriber-level accounts

How to Mitigate CVE-2026-73363

Immediate Actions Required

Update the Taxi Booking Manager for WooCommerce plugin to version 2.0.8 or later on all WordPress instances
Audit existing user accounts and remove unnecessary low-privileged accounts that could be leveraged for exploitation
Review recent booking and order records for signs of unauthorized modification

Patch Information

Upgrade the ecab-taxi-booking-manager plugin to version 2.0.8 or newer. The vendor addressed the missing authorization checks in this release. Consult the Patchstack WordPress Vulnerability Report for full remediation details.

Workarounds

Restrict access to the WordPress site to trusted IP ranges until the plugin is updated
Temporarily disable the Taxi Booking Manager for WooCommerce plugin if immediate patching is not possible
Deploy a web application firewall rule to block unauthenticated and low-privileged requests to vulnerable plugin endpoints

bash

# Update the plugin using WP-CLI
wp plugin update ecab-taxi-booking-manager --version=2.0.8

# Verify installed version
wp plugin get ecab-taxi-booking-manager --field=version