WordPress Plugin Vulnerabilities

E-cab Taxi Booking Manager for Woocommerce < 2.0.8 - Missing Authorization

Description

The E-cab Taxi Booking Manager for Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 2.0.8 (exclusive). This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
ecab-taxi-booking-manager
Fixed in 2.0.8

References

CVE
CVE-2026-93928
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9c4a5bdd-4b4b-49a0-90d6-9f72c0a662d1

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Thaer Assfour
Verified
No
WPVDB ID
50a4d789-75c7-4c23-9ae5-8f05c499d18f

Timeline

Publicly Published
2026-09-19 (about 28 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2026-09-28
Title
Paid Member Subscriptions < 3.1.0 - Unauthenticated Subscription Activation via Stripe SCA Resume AJAX Endpoint
Published
2026-08-31
Title
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
Published
2021-12-08
Title
Registration Magic < 5.0.1.8 - Authentication Bypass
Published
2024-10-28
Title
Crypto < 2.19 - Authentication Bypass via log_in
Published
2026-10-09
Title
Advanced Form Integration < 2.10.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action