Executive brief
The E-cab Taxi Booking Manager plugin for WooCommerce calculates taxi booking fares on the client side without server-side validation. Unauthenticated attackers can forge distance and price parameters to manipulate booking costs down to zero, allowing them to place real taxi orders for free or at arbitrary prices, directly harming taxi operators' revenue.
Technical details
The vulnerability is an input validation flaw in the mptbm_add_to_cart AJAX endpoint. The plugin accepts client-supplied trip distance and base-price values (via mptbm_distance, mptbm_threshold_base_price, and related parameters) and uses them to calculate order totals without server-side verification against the actual route. Unauthenticated attackers can craft requests via the WordPress admin-ajax.php endpoint, specifying a distance of 1 meter or negative base prices to reduce the calculated total to zero. The plugin then allows these manipulated orders to proceed through WooCommerce checkout via the Store API, bypassing payment when a method like Cash on Delivery is enabled. The vulnerability affects versions before 2.0.5 and is fixed in 2.0.5 and later.
Affected products
- E-cab Taxi Booking Manager for WooCommerce before 2.0.5
Timeline
- 2026-09-02: disclosed
- 2026-09-04: advisory