The vulnerability described in the CVE allows authentication circumvention by means of an alternate path or channel, giving attackers the ability to assume privileged access in the Taxi Booking Manager for WooCommerce plugin. The weakness is classified as CWE‑288. Attackers could misuse the bypass to create unauthenticated sessions or impersonate authenticated users, resulting in full control over the booking manager section and potentially the entire WordPress admin area.

The product affected is the Taxi Booking Manager for WooCommerce plugin developed by magepeopleteam. Versions from the earliest release up to and including 1.3.0 are vulnerable. The issue is present in all builds tagged 1.3.0 or earlier, regardless of the underlying WordPress core version.

The CVSS score of 9.8 marks this flaw as critical. The EPSS score is below 1 %, indicating that, relative to all reported exploits, the probability of automated or widespread exploitation is low at this time. The functionality is not listed in CISA KEV. The likely attack vector is through HTTP requests to the plugin’s authentication endpoints, which can be performed remotely. An attacker only needs to identify an alternate path or channel capable of bypassing normal login checks. Once logged in as a privileged user, the attacker can make arbitrary changes within the booking manager content or user data.