The E-cab Taxi Booking Manager for Woocommerce plugin suffers from a missing authorization vulnerability (CWE-862) that enables unauthenticated attackers to modify arbitrary users' email addresses. This lack of capability and identity validation allows attackers to reset passwords and gain unauthorized access to user accounts, including administrators. The issue affects all versions up to and including 1.3.0. CVE-2025-54713 is likely a duplicate of this vulnerability. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to take over any user account by changing the email address and resetting the password, including administrator accounts. This leads to full compromise of the affected WordPress site and potentially all data and functionality managed by the plugin and site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity. Avoid using affected versions and consider disabling the plugin if possible.