{"id":"CVE-2026-84045","aliases":["EUVD-2026-70993","GHSA-5h32-fhrg-6q48"],"status":"published","title":"E-cab Taxi Booking Manager for Woocommerce \u003c 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart","description":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00324,"percentile":0.25702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-09-04T10:02:33Z","modified":"2026-09-08T19:15:18Z","products":[{"vendor":"magepeopleteam","product":"e-cab taxi booking manager for woocommerce"},{"vendor":"unknown","product":"e-cab taxi booking manager for woocommerce"}],"references":[{"url":"https://wpscan.com/vulnerability/241a7890-81b3-4685-a243-e774d560f17a/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84045"},{"url":"https://wpscan.com/vulnerability/241a7890-81b3-4685-a243-e774d560f17a"},{"url":"https://github.com/advisories/GHSA-5h32-fhrg-6q48"}],"sources":{"cve":[{"id":"CVE-2026-84045","title":"E-cab Taxi Booking Manager for Woocommerce \u003c 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart","description":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.","status":"published","published":"2026-09-04T10:02:33.451Z","modified":"2026-09-04T16:50:11.619Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-70993","description":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.","status":"published","published":"2026-09-04T10:02:33Z","modified":"2026-09-04T16:50:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:12.302717Z"}],"ghsa":[{"id":"GHSA-5h32-fhrg-6q48","title":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a...","description":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.","status":"published","published":"2026-09-04T12:30:56Z","modified":"2026-09-04T12:31:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:11:21.957806Z"}],"nvd":[{"id":"CVE-2026-84045","description":"The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.","status":"published","published":"2026-09-04T11:17:19.213Z","modified":"2026-09-08T19:15:18.627Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:43.737972Z"}]}}