This vulnerability, identified as CWE-862 (Missing Authorization), exists in the Taxi Booking Manager for WooCommerce plugin versions before 2.0.8. It allows an attacker with low privileges to bypass access controls without authentication, leading to unauthorized modification of data (integrity impact). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no user interaction, and no confidentiality or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with low privileges can exploit missing authorization controls to perform unauthorized actions that compromise data integrity. There is no impact on confidentiality or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to unauthorized modifications.