PT-2025-33540 · WordPress · Taxi Booking Manager For Woocommerce | E-Cab Plugin+1

Phat Rio · Published 2025-08-16 · Updated 2025-08-21 · CVE-2025-8898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: E-cab plugin for WordPress versions prior to 1.3.1

Description: The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to insufficient validation of a user's capabilities before updating plugin settings or user details, such as the email address. This allows unauthenticated attackers to modify arbitrary user email addresses, including those of administrators, and subsequently reset passwords to gain account access.

Recommendations: Update the E-cab plugin to version 1.3.1 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-8898

Affected Products

E-Cab Plugin

Taxi Booking Manager For Woocommerce | E-Cab Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-8898 · Security Note
• https://t.me/CVEtracker/30187 · Telegram Post
• https://twitter.com/cracbot/status/1958484275067539466 · Twitter Post
• https://twitter.com/CveFindCom/status/1956614547210428419 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3343878/ecab-taxi-booking-manager/trunk/inc/MPTBM_Rest_Api.php · Note
• https://twitter.com/CVEnew/status/1956654775799623855 · Twitter Post
• https://t.me/cveNotify/132572 · Telegram Post
• https://wordpress.org/plugins/ecab-taxi-booking-manager · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fd50ac2c-3049-4a44-b7f8-a5f87c42555c?source=cve · Note