CVE-2026-84045
Received Received - Intake

Unauthenticated Price Manipulation in E-cab Taxi Booking Manager for Woocommerce

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-84045
EUVD
EUVD-2026-70993

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ecab taxi_booking_manager to 2.0.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the E-cab Taxi Booking Manager for WooCommerce plugin before version 2.0.5 allows unauthenticated attackers to manipulate the price of taxi bookings by sending invalid trip distance and base price values. The plugin fails to validate these inputs on the server side, enabling attackers to set the order total to zero or any arbitrary price.

Detection Guidance

Check the installed version of the E-cab Taxi Booking Manager plugin in your WordPress admin panel. If the version is below 2.0.5, the system is vulnerable. Look for unusual booking orders with zero or manipulated prices as potential signs of exploitation.

Impact Analysis

If exploited, this vulnerability could allow attackers to place taxi bookings for free or at a price they set, leading to financial losses for the taxi service provider. It may also disrupt normal booking operations and erode customer trust.

Compliance Impact

This vulnerability could lead to unauthorized financial transactions, potentially violating compliance requirements under GDPR (data protection) and HIPAA (privacy and security) by exposing sensitive user data and financial information through manipulated bookings.

Mitigation Strategies

Update the E-cab Taxi Booking Manager plugin to version 2.0.5 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart