{"id":"CVE-2026-114181","kind":"vulnerability","aliases":["CVE-2026-114181"],"related":[],"title":"Taxi Booking Manager for WooCommerce: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.","summary":"Taxi Booking Manager for WooCommerce, a WordPress plugin from Magepeople, has a missing authorization check in versions through 2.1.6. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","taxi-booking","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `ecab-taxi-booking-manager` plugin in the WordPress admin plugin list.\n- Compare the installed version against `2.1.6`; the sources say versions through `2.1.6` are affected.","fix":null,"status":"open","published_at":"2026-10-29T15:17:16+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:02+00:00","updated_at":"2026-10-29T15:27:02+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T15:27:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Taxi Booking Manager for WooCommerce: missing authorization check exposes access controls","impact":"medium","summary":"Taxi Booking Manager for WooCommerce, a WordPress plugin from Magepeople, has a missing authorization check in versions through 2.1.6. The sources say an attacker can exploit incorrectly configured access control levels to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","taxi-booking"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted booking functions; extent unknown","analyst_note":"Check the NVD entry and the plugin vendor's changelog for the affected endpoints, required privileges and a fixed version.","how_to_check":"- Check the installed version of the `ecab-taxi-booking-manager` plugin in the WordPress admin plugin list.\n- Compare the installed version against `2.1.6`; the sources say versions through `2.1.6` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Taxi Booking Manager for WooCommerce plugin (ecab-taxi-booking-manager) at version 2.1.6 or earlier are in scope. The sources do not say which specific endpoints or roles are reachable, so whether a given site is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4120,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114181':14A,17A '-2026':13A,16A '2.1.6':42B,92C 'access':10A,52B,78C 'affect':83C 'allow':74C 'attack':47B 'author':7A,37B,59C 'book':2A,21B,25B,65C,72C,85C 'check':8A,38B 'configur':51B,77C 'control':11A,53B,79C 'cve':12A,15A 'ecab':70C 'ecab-taxi-booking-manag':69C 'exploit':49B,75C 'expos':9A 'function':57B 'inc':63C 'incorrect':50B,76C 'issu':82C 'level':54B 'levels.this':81C 'magepeopl':33B,62C 'manag':3A,26B,66C,73C,86C 'miss':6A,36B,58C 'n/a':90C 'packag':18B 'plugin':31B 'reach':56B 'say':45B 'secur':80C 'sourc':44B 'taxi':1A,20B,24B,64C,71C,84C 'taxi-book':19B 'version':40B 'vulner':60C 'woocommerc':5A,22B,28B,68C,88C 'wordpress':23B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Taxi Booking Manager for WooCommerce plugin (ecab-taxi-booking-manager) at version 2.1.6 or earlier are in scope. The sources do not say which specific endpoints or roles are reachable, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114181","severity":null,"published_at":"2026-10-29T15:17:16+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}