Executive brief
The Cab Fare Calculator plugin for WordPress, used by transportation services to manage bookings and pricing, contains a security flaw. An unauthenticated attacker can exploit this to read sensitive files from the web server, such as configuration files containing database credentials. This could lead to a full compromise of the website's data and underlying server infrastructure.
Technical details
A local file inclusion (LFI) vulnerability exists in the 'cab-fare-calculator' WordPress plugin version 1.0.3. The flaw is located in the 'tblight.php' file, which fails to properly sanitize the 'controller' GET parameter before passing it to a 'require_once' statement. An unauthenticated attacker can use path traversal sequences (e.g., '../../') to bypass the intended directory and include arbitrary PHP files or read sensitive system files from the server. While the CVSS vector provided by the source indicates local access, the exploit mechanism via GET parameters suggests it is reachable over the network if the plugin is active on a web-facing WordPress instance.
Affected products
- kanev cab-fare-calculator 1.0.3
Timeline
- 2022-03-24: disclosed: Initial discovery by researcher Hassan Khan Yusufzai
- 2022-03-30: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published