PT-2026-39479 · WordPress · Cab Fare Calculator

Published 2026-05-10 · Updated 2026-05-10 · CVE-2022-50954

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cab-fare-calculator version 1.0.3

Description An issue in the WordPress plugin allows unauthenticated attackers to read arbitrary files. By supplying path traversal sequences through the controller GET parameter in the 'tblight.php' endpoint, an attacker can include and execute files located outside the intended controllers directory. Local File Inclusion (LFI) is a flaw that allows an attacker to include files on a server that are not intended to be exposed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2022-50954

Affected Products

Cab Fare Calculator

References · 6

• 🔥 https://exploit-db.com/exploits/50843 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50954 · Security Note
• https://wordpress.org/plugins/cab-fare-calculator · Note
• https://twitter.com/CVEnew/status/2053537462442770737 · Twitter Post
• https://vulncheck.com/advisories/wordpress-plugin-cab-fare-calculator-local-file-inclusion · Note
• https://t.me/CVEtracker/53302 · Telegram Post