Critical · published August 16, 2025
🚨 Unauthenticated attackers can change an admin's email in the Taxi Booking Manager for WooCommerce! That's like letting a stranger change the password to your bank account without even showing ID! 🔥 Picture a hotel manager who leaves the front desk unattended, allowing anyone to walk in and change the reservation details of any guest. This vulnerability works similarly – if users aren't properly authenticated, anyone can just waltz in and switch the email addresses of accounts at will! The consequences here are absolutely devastating. An attacker can take over any account by simply changing the email, including administrators. This means they can reset passwords, gain full access to the account, and potentially wreak havoc on your entire site!
Picture a hotel manager who leaves the front desk unattended, allowing anyone to walk in and change the reservation details of any guest. This vulnerability works similarly – if users aren't properly authenticated, anyone can just waltz in and switch the email addresses of accounts at will! This vulnerability in the Taxi Booking Manager for WooCommerce arises because the plugin fails to validate user capabilities when updating settings. As a result, unauthenticated users can change email addresses and take control of accounts.
The consequences here are absolutely devastating. An attacker can take over any account by simply changing the email, including administrators. This means they can reset passwords, gain full access to the account, and potentially wreak havoc on your entire site! To protect your site, update the Taxi Booking Manager plugin to version 1.3.1 or later immediately. It's also wise to conduct a security audit of user accounts and ensure that all access control measures are in place. ⚠️ Don't forget to monitor for any unusual activity! You've got this! With quick action, you can secure your site in no time. 🛡️