The E‑cab Taxi Booking Manager for WooCommerce plugin fails to verify a user’s capabilities before allowing changes to settings or user details. An unauthenticated attacker can alter any user’s email address, including those of administrators. The attacker can then reset that user’s password and assume the account, effectively obtaining full control of the WordPress site. The flaw therefore represents a privilege‑escalation and account‑takeover vulnerability (CWE‑862).

All installations of the MagePeopleTeam E‑cab Taxi Booking Manager for WooCommerce, version 1.3.0 or earlier, are vulnerable. The issue exists on every WordPress site that runs these plugin versions. Site owners should identify whether their current installation falls into this range.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting low exploitation probability at the time of analysis, and it is not listed in the CISA KEV catalog. This flaw allows an unauthenticated attacker to change any user’s email address, privilege the account and reset passwords. Based on the description, it is inferred that the attacker could use the plugin’s exposed settings or user‑management controls without authentication to carry out the change.