MagePeople Taxi Booking Manager for WooCommerce PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the Taxi Booking Manager for WooCommerce plugin, affecting versions through 1.1.8. This vulnerability could potentially lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which is a type of code injection that can lead to various consequences, including remote code execution, SQL injection, path traversal, and denial-of-service, if a proper object injection chain is available.

Remediation

Users of the Taxi Booking Manager for WooCommerce plugin should update to version 1.1.9 or later. Patchstack users can enable auto-update for vulnerable plugins.