The vulnerability CVE-2025-24661 affects the Taxi Booking Manager for WooCommerce plugin (versions up to 1.1.8) by magepeopleteam. It is caused by unsafe deserialization of untrusted data, which allows an attacker to perform object injection. This can lead to remote code execution or other severe impacts on the affected system. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Users should monitor the vendor's communications for updates and apply any official fixes once available. Until then, restricting access to the affected plugin and minimizing privileges may reduce risk.