E-Cab Taxi Booking Manager for WooCommerce Privilege Escalation Vulnerability Allowing Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the E-Cab Taxi Booking Manager for WooCommerce plugin, affecting all versions through 1.3.0. The vulnerability arises because the plugin fails to properly validate user capabilities before allowing updates to plugin settings or user details, such as email addresses. This flaw enables unauthenticated attackers to change the email addresses of arbitrary users, including administrators. Attackers can then use the email change to reset the user's password and gain access to their account.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including those of administrators, potentially leading to further actions within the WordPress site.

Remediation

Users are advised to update the E-Cab Taxi Booking Manager for WooCommerce plugin to version 1.3.1 or a newer patched version.