Introduction
Attackers can take over any WordPress account, including administrators, on sites running Taxi Booking Manager for WooCommerce up to version 1.3.0. Unauthenticated users can change the email address on any account and then reset its password, which gives them full privilege escalation. Sites that use this plugin for taxi and chauffeur booking services are at risk of total compromise if they stay unpatched.
About the plugin: Taxi Booking Manager for WooCommerce (also called E-cab) is a specialized WordPress plugin developed by MagePeople Team. It integrates with WooCommerce to provide dynamic taxi and chauffeur booking, fare calculation, payment gateways, and Google Maps support. Transportation service providers use it widely to manage online bookings directly from their WordPress sites.
Technical information
CVE-2025-8898 comes from missing authorization checks in the plugin's REST API endpoints that update user details and plugin settings. The vulnerable code is in the plugin's REST API handler (see public diff).
Vulnerability mechanism:
- The plugin exposes API endpoints that update user details, including email addresses, and plugin settings.
- These endpoints do not check the requester's capabilities or identity before they process an update.
- An unauthenticated attacker can send a crafted HTTP request to a vulnerable endpoint with the target user's identifier and a new email address.
- The plugin immediately updates the target user's email address without any validation.
- The attacker then uses the standard WordPress password reset feature. Because the email address is now attacker-controlled, the reset link goes to the attacker, who can set a new password and gain full access to the account.
- This works for any user, including those with administrator privileges.
Root cause: The vulnerability is classified as CWE-862 (Missing Authorization). The plugin does not check user capabilities and identity before it allows sensitive operations through its REST API. The flaw is present in all versions up to and including 1.3.0.
No public code snippet is available, but the issue is documented in the plugin's REST API handler (see changeset).
Affected systems and versions
- Product: Taxi Booking Manager for WooCommerce (E-cab) WordPress plugin
- Affected versions: All versions up to and including 1.3.0
- Any WordPress site with this plugin at or below version 1.3.0 is vulnerable
Vendor security history
MagePeople Team, the developer of Taxi Booking Manager, has a history of critical vulnerabilities in this product line:
- CVE-2025-30839: Missing authorization in versions up to 1.2.1
- CVE-2025-24661: PHP object injection in versions up to 1.1.8
- CVE-2024-43986: Stored XSS in versions up to 1.0.9
The repeated authorization and input validation issues suggest systemic gaps in secure development and testing. Patch response times have varied. For organizations that rely on this plugin for business-critical operations, the vendor's security maturity is a concern.
