The plugin contains a missing authorization check that allows an attacker to bypass intended access controls and gain unauthorized access to administrative functions within the WordPress Taxi Booking Manager for WooCommerce. This vulnerability can enable attackers to view, modify, or delete booking information and potentially alter business operations, as it originates from a missing security level enforcement.

Magepeople inc. Taxi Booking Manager for WooCommerce WordPress plugin versions from n/a through 2.0.1 are vulnerable to this broken access control flaw. All releases prior to 2.0.2 may expose the same missing authorization behavior.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the issue is not listed in CISA KEV. The flaw is exploitable through the web application’s administrative interface, so a remote attacker with access to the site or its endpoints could trigger the unauthorized action. In the absence of additional network protections, the attack vector is likely Remote via HTTP/HTTPS requests made to the vulnerable URLs. No local privilege escalation is required, but the compromise could affect data confidentiality, integrity, and operational availability of the booking system.