CVE-2026-93928 Overview
CVE-2026-93928 is an authentication bypass vulnerability in the Magepeople Taxi Booking Manager for WooCommerce WordPress plugin. The flaw enables unauthenticated attackers to bypass authentication controls through an alternate path or channel [CWE-288]. It affects all plugin versions prior to 2.0.8 and is exploitable remotely over the network without user interaction. The issue impacts the confidentiality, integrity, and availability of affected WordPress sites running the vulnerable plugin.
Critical Impact
Remote unauthenticated attackers can bypass authentication in the Taxi Booking Manager for WooCommerce plugin, gaining access to functionality or data intended for authenticated users.
Affected Products
- Magepeople Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager)
- All versions prior to 2.0.8
- WordPress installations with the affected plugin enabled
Discovery Timeline
- 2026-09-22 - CVE CVE-2026-93928 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93928
Vulnerability Analysis
The vulnerability is categorized as Authentication Bypass Using an Alternate Path or Channel [CWE-288]. The plugin exposes functionality that should require authentication through a secondary code path that fails to enforce identity or session checks. An attacker can reach protected operations without presenting valid credentials.
Exploitation requires no privileges and no user interaction. The attack vector is network-based, making the flaw reachable across the public internet on any WordPress site running a vulnerable version of the plugin. Successful exploitation can lead to unauthorized access to booking data, user records, or administrative operations exposed by the plugin.
Root Cause
The root cause is missing or insufficient authentication enforcement on one or more plugin endpoints. When the plugin exposes handlers such as AJAX actions or REST routes, authorization callbacks or capability checks are either absent or bypassable via alternate parameters. See the Patchstack Vulnerability Report for advisory details.
Attack Vector
An unauthenticated remote attacker sends crafted HTTP requests to the vulnerable plugin endpoints. Because the alternate code path skips authentication, the request is processed as if the caller were authorized. Specific exploitation details have not been published in the referenced advisory to limit active abuse.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93928
Indicators of Compromise
- Unexpected HTTP requests to wp-admin/admin-ajax.php referencing plugin actions from the ecab-taxi-booking-manager plugin.
- Unauthenticated access to plugin REST routes or handlers that return booking, customer, or configuration data.
- New or modified booking records, user accounts, or plugin settings without corresponding admin login activity in WordPress audit logs.
Detection Strategies
- Inventory WordPress sites and identify installations of Taxi Booking Manager for WooCommerce with a version below 2.0.8.
- Correlate web server access logs with WordPress authentication logs to identify requests to protected plugin actions lacking a valid session cookie.
- Alert on anomalous HTTP request patterns targeting plugin action names, especially from external IP ranges.
Monitoring Recommendations
- Enable verbose logging on the WordPress site and forward web, application, and audit logs to a centralized analytics platform for correlation.
- Monitor for spikes in POST requests to admin-ajax.php associated with the vulnerable plugin.
- Track plugin version drift across managed WordPress sites and flag hosts still running versions prior to 2.0.8.
How to Mitigate CVE-2026-93928
Immediate Actions Required
- Upgrade the Taxi Booking Manager for WooCommerce plugin to version 2.0.8 or later on all WordPress sites.
- If an immediate upgrade is not feasible, disable and remove the plugin until the patched version can be deployed.
- Review WordPress user accounts, booking records, and audit logs for signs of unauthorized changes since the plugin was installed.
Patch Information
The vendor has released version 2.0.8 of the plugin, which addresses the authentication bypass. Administrators should update through the WordPress plugin management interface or by replacing the plugin files with the patched release. Details are available in the Patchstack Vulnerability Report.
Workarounds
- Restrict access to the WordPress site or the vulnerable plugin endpoints using a web application firewall (WAF) with rules targeting the affected plugin actions.
- Block unauthenticated requests to wp-admin/admin-ajax.php for plugin-specific actions using server-level access controls until patching is complete.
- Enforce IP allowlisting on administrative and booking-management interfaces where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
