CVE-2026-84045: CWE-472 External Control of Assumed-Immutable Web Parameter in E-cab Taxi Booking Manager for Woocommerce
Description
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
CVSS v3.1
Score 5.3medium
Affected software
E-cab Taxi Booking Manager for Woocommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84045 is a vulnerability in the E-cab Taxi Booking Manager for Woocommerce WordPress plugin (versions before 2.0.5) that arises from the lack of server-side validation of client-supplied trip distance and base-price parameters. This external control of assumed-immutable web parameters (CWE-472) enables unauthenticated attackers to alter the order total, potentially reducing it to zero, thereby placing taxi-booking orders at arbitrary prices without authorization.
Potential Impact
The vulnerability allows attackers to manipulate booking prices, potentially causing financial loss by placing orders at reduced or zero cost. There is no impact on confidentiality or availability reported. The CVSS score is 5.3 (medium severity), reflecting the integrity impact due to price manipulation without requiring authentication.
Mitigation Recommendations
No official patch or remediation level is currently reported for this vulnerability. Users should monitor the vendor's advisory for updates and apply any official fixes once available. Until then, consider implementing server-side validation of pricing parameters as a temporary mitigation to prevent manipulation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-01T04:02:35.803Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9a9bf4acd9273b496ca313
Added to database: 09/04/2026, 10:22:44 UTC
Last enriched: 09/07/2026, 12:08:23 UTC
Last updated: 10/18/2026, 18:48:24 UTC
Views: 92
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.