CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
Explanation of Vulnerability in Simple Terms
The Taxi Booking Manager for WooCommerce plugin contains a deserialization vulnerability in versions up to 1.1.8. An authenticated attacker can send specially crafted data that the plugin deserializes without proper validation, allowing them to execute arbitrary code on the site. This affects confidentiality, integrity, and availability of the WordPress installation.
What an attacker can do
Run arbitrary code on the site with the privileges of the WordPress user account.
Potential impact on your site
An authenticated attacker can compromise your entire WordPress site, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
External resources
Related vulnerabilities
