Privilege Escalation Vulnerability in Taxi Booking Manager for Woocommerce by E-cab

CVE-2025-8898

What is CVE-2025-8898?

The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is susceptible to a privilege escalation vulnerability that enables unauthorized users to take control of accounts, including those of administrators. This issue arises from inadequate validation of user permissions when modifying plugin settings or updating user details, such as email addresses. Attackers can exploit this flaw by altering arbitrary users' email addresses, which would allow them to reset passwords and gain unauthorized access to these accounts. All versions up to and including 1.3.0 are affected, making it imperative for users to ensure their installations are updated and secure.

References