The E‑cab Taxi Booking Manager for WooCommerce plugin fails to validate the trip distance and base‑price supplied by a client at the server side when calculating a booking price, allowing an unauthenticated attacker to adjust the order total to zero or another arbitrary amount. This flaw enables the creation of legitimate-looking taxi‑booking orders without any payment, potentially resulting in financial loss or fraud. The core weakness is a lack of proper input validation and access control, which manifests as a direct manipulation of critical business logic.

WordPress sites using the E‑cab Taxi Booking Manager for WooCommerce plugin version prior to 2.0.5 are affected. The vulnerability resides in the "mptbm_add_to_cart" endpoint, which accepts distance and base‑price parameters from the client without server‑side checks.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack appears to be remote, requiring only an unauthenticated web request to the booking endpoint. By manipulating the parameters in the add‑to‑cart action, an attacker can set the total to zero and place a booking that will be processed as if paid. No authentication or privileged state is required, making the exploitation straightforward for any client that can reach the affected website.