The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This vulnerability arises from the plugin’s failure to properly validate a user’s capabilities before updating settings or their identity before changing details like email addresses. As a result, unauthenticated attackers can change arbitrary users’ email addresses, including those of administrators, allowing them to reset passwords and gain unauthorized access to accounts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-8898 |
Exploitation
To exploit this vulnerability, an attacker can send a crafted request to the plugin’s API to change the email address of any user, including administrators, without authentication. By doing so, the attacker can then initiate a password reset process, gaining access to the targeted account.
Affected Products
- Taxi Booking Manager for Woocommerce | E-cab plugin (all versions up to 1.3.0): This plugin allows users to manage taxi bookings but is vulnerable to unauthorized account access due to improper validation of user capabilities.
Mitigation
To mitigate this vulnerability, users should update the Taxi Booking Manager for Woocommerce | E-cab plugin to the latest version where the issue has been addressed. Additionally, it is recommended to review user permissions and implement strong password policies to enhance account security.