PT-2025-33540 · WordPress · Taxi Booking Manager For Woocommerce | E-Cab Plugin+1

Phat Rio · CVE-2025-8898 · Publicado 2025-08-16 · Atualizado 2025-08-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: E-cab plugin for WordPress versions prior to 1.3.1

Description: The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of a user's capabilities before updating plugin settings or user details, such as the email address. This allows unauthenticated attackers to modify arbitrary user email addresses, including those of administrators, and subsequently reset passwords to gain account access.

Recommendations: Update the E-cab plugin to version 1.3.1 or later.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-8898

Produtos afetados

E-Cab Plugin

Taxi Booking Manager For Woocommerce | E-Cab Plugin

Referências · 9

• https://t.me/CVEtracker/30187 · Publicação no Telegram
• https://twitter.com/cracbot/status/1958484275067539466 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1956614547210428419 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3343878/ecab-taxi-booking-manager/trunk/inc/MPTBM_Rest_Api.php · Nota
• https://twitter.com/CVEnew/status/1956654775799623855 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-8898 · Nota de Segurança
• https://t.me/cveNotify/132572 · Publicação no Telegram
• https://wordpress.org/plugins/ecab-taxi-booking-manager · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/fd50ac2c-3049-4a44-b7f8-a5f87c42555c?source=cve · Nota