This vulnerability (CWE-862) in Taxi Booking Manager for WooCommerce arises from missing authorization checks, enabling attackers to bypass access control mechanisms. It affects all versions up to 2.0.1. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor-provided patch or official remediation level is documented. The product is not a cloud service, so remediation depends on the vendor releasing an update.

Exploitation of this vulnerability could allow an unauthenticated attacker to access or perform actions that should be restricted, potentially leading to limited information disclosure. There is no impact on data integrity or availability reported. The medium severity reflects the moderate risk posed by unauthorized access to sensitive booking information or related data within the WooCommerce environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from Magepeople inc. and consider restricting access to the plugin's functionality where possible. No vendor advisory indicates that the issue is already mitigated or that no action is required.