Taxi Booking Manager has an unauthenticated authentication-bypass path
The affected authentication boundary can be bypassed through an alternate path or channel. The CNA vector requires no attacker account and assigns low confidentiality, integrity and availability impacts. The endpoint, input, bypass mechanism, resulting identity and accessible actions are unspecified; administrator account takeover is not established. Affected versions: n/a to < 2.0.8. Confirmed fixed release: 2.0.8.
- Component
- Taxi Booking Manager for WooCommerce
- Plugin slug
ecab-taxi-booking-manager- Affected
- n/a to < 2.0.8
- Safe version
2.0.8- Published
- Sep 22, 2026
This CVE was published Sep 22, 2026 and is one of 12 known issues for this plugin.
Update, patch or deactivate.
Update to 2.0.8 or later. Update the component. Enforce the same server-side authentication and authorization checks on every route reaching protected booking operations, including alternate callbacks. Disable the affected integration if it cannot be safely updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L