CVE-2026-84045: E-cab Taxi Booking Manager Auth Bypass Flaw

CVE-2026-84045 Overview

CVE-2026-84045 affects the E-cab Taxi Booking Manager for WooCommerce WordPress plugin in versions prior to 2.0.5. The plugin trusts client-supplied trip distance and base-price values when calculating booking totals. Unauthenticated attackers can manipulate the request payload to lower the order total, including reducing it to zero, and place real taxi-booking orders at an arbitrary price. The flaw is a business logic error rooted in missing server-side validation of pricing inputs.

Critical Impact

Unauthenticated remote attackers can place valid taxi bookings at attacker-chosen prices, including free rides, causing direct revenue loss and fraudulent order fulfillment.

Affected Products

• E-cab Taxi Booking Manager for WooCommerce WordPress plugin versions before 2.0.5
• WordPress sites running WooCommerce with the vulnerable plugin installed
• E-commerce environments exposing the booking flow to unauthenticated users

Discovery Timeline

• 2026-09-04 - CVE-2026-84045 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84045

Vulnerability Analysis

The plugin implements pricing logic that accepts trip distance and base-price fields directly from the booking request. The server persists the resulting order total without recomputing the price from trusted server-side inputs such as configured tariffs, geocoded distance, or authenticated rate tables. An attacker who intercepts or crafts the booking request can substitute arbitrary values in the pricing parameters. The plugin then generates a valid WooCommerce order at that manipulated total.

Because the endpoint does not require authentication, exploitation requires no account and no user interaction. The vulnerability class is a business logic flaw combined with improper input validation of price-affecting parameters. It does not corrupt memory or execute code; the integrity impact is limited to order data and transactional records.

Root Cause

The root cause is client-side trust of pricing inputs. The plugin uses distance and base-price values from the HTTP request as the authoritative pricing basis rather than deriving them server-side. There is no cross-check against configured tariff rules before the order is written to the WooCommerce order store.

Attack Vector

An unauthenticated attacker submits a crafted booking request to the plugin's public booking endpoint with modified distance and base_price (or equivalent) fields set to zero or an attacker-chosen value. WooCommerce accepts the resulting order total and creates a legitimate booking record. The attacker completes checkout at the manipulated price. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-84045

Indicators of Compromise

• WooCommerce orders created through the E-cab plugin with totals of 0.00 or values substantially below the configured minimum fare
• Booking records where the stored trip distance is inconsistent with the pickup and drop-off addresses
• Repeated booking submissions from the same IP address with anomalous pricing parameters

Detection Strategies

• Review WooCommerce order logs for taxi bookings whose totals fall below the minimum configured tariff for the stated distance
• Correlate HTTP POST requests to the plugin's booking endpoint with resulting order totals to identify parameter tampering
• Monitor web application firewall logs for requests where numeric pricing parameters deviate from expected server-computed ranges

Monitoring Recommendations

• Enable verbose WooCommerce logging for order creation events tied to the E-cab plugin
• Alert on any booking order created with a total of zero or below a defined fraud threshold
• Track unauthenticated POST volume to the plugin endpoint and flag bursts from single sources

How to Mitigate CVE-2026-84045

Immediate Actions Required

• Update the E-cab Taxi Booking Manager for WooCommerce plugin to version 2.0.5 or later on every affected WordPress site
• Audit existing WooCommerce orders created before patching for anomalous totals and cancel fraudulent bookings
• Restrict access to the booking endpoint behind a web application firewall rule that validates pricing parameter ranges

Patch Information

The vendor addressed the issue in version 2.0.5 of the plugin by moving price computation to the server. Refer to the WPScan Vulnerability Report for the vendor advisory reference and version metadata.

Workarounds

• Disable the E-cab Taxi Booking Manager plugin until the site is upgraded to version 2.0.5
• Deploy a WAF rule that rejects booking requests containing a base_price of zero or a distance value below a minimum threshold
• Implement a manual review step for all new taxi bookings before fulfillment while the plugin remains unpatched

# Configuration example: WP-CLI update to the patched version
wp plugin update e-cab-taxi-booking-manager-for-woocommerce --version=2.0.5
wp plugin get e-cab-taxi-booking-manager-for-woocommerce --field=version