CVE-2026-84045: 
WordPress vulnerability analysis and mitigation

CVE-2026-84045 is an unauthenticated price manipulation vulnerability in the E-cab Taxi Booking Manager for WooCommerce WordPress plugin affecting versions 2.0.1 through before 2.0.5. The flaw allows unauthenticated attackers to manipulate client-supplied trip distance and base-price values to reduce booking order totals to zero or an arbitrary amount. It was publicly disclosed on September 2, 2026, and a patch was published on September 4, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is a missing server-side validation of client-supplied booking parameters — specifically trip distance and base-price — before the order total is calculated (CWE-472: External Control of Assumed-Immutable Web Parameter). The plugin's mptbm_add_to_cart handler trusts values submitted by the client without re-computing or verifying the price on the server side. An unauthenticated attacker can intercept or craft a booking request and tamper with these parameters to set the order total to zero or any arbitrary value before submission. No authentication or special privileges are required, and exploitation is fully automatable over the network (WPScan, GitHub Advisory).

Successful exploitation allows unauthenticated attackers to place real taxi-booking orders at zero cost or an arbitrarily low price, directly causing financial loss to the business operating the plugin. The integrity of the booking and payment system is compromised, as order totals no longer reflect actual service costs. There is no confidentiality or availability impact; the vulnerability is limited to integrity tampering of pricing data (WPScan, GitHub Advisory).

No public proof-of-concept exploit code is currently available; WPScan has indicated a PoC will be published on September 16, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.194%, indicating a low near-term exploitation probability. The attack is automatable and requires no authentication, which lowers the barrier for opportunistic abuse once a PoC is released (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the E-cab Taxi Booking Manager for WooCommerce plugin (versions 2.0.1–2.0.4) by scanning for plugin-specific assets (e.g., /wp-content/plugins/ecab-taxi-booking-manager/) or using tools like WPScan.
2. Initiate a booking request: Navigate to the taxi booking form on the target site and begin a legitimate booking to observe the normal request structure.
3. Intercept the add-to-cart request: Use a proxy tool (e.g., Burp Suite) to intercept the HTTP request sent to the mptbm_add_to_cart handler when the booking is submitted.
4. Tamper with pricing parameters: Modify the client-supplied trip_distance and base_price (or equivalent) parameters in the intercepted request, setting them to zero or a minimal value to reduce the order total.
5. Submit the manipulated request: Forward the modified request to the server. Because no server-side validation is performed, the plugin accepts the tampered values and creates a real booking order at the manipulated price.
6. Complete checkout: Proceed through WooCommerce checkout to place a confirmed taxi booking at zero or near-zero cost (WPScan).

• Network: Unusual POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) or equivalent with action=mptbm_add_to_cart containing anomalously low or zero values for trip distance or base-price parameters.
• Logs: WordPress/WooCommerce order logs showing completed taxi bookings with order totals of $0.00 or suspiciously low amounts; repeated booking submissions from the same IP address in a short timeframe.
• Application: WooCommerce orders for taxi bookings with pricing inconsistent with configured rates; orders placed by guest (unauthenticated) users with zero-value totals (WPScan).

Update the E-cab Taxi Booking Manager for WooCommerce plugin to version 2.0.5 or later, which introduces server-side validation of booking pricing parameters (WPScan, GitHub Advisory). As a temporary workaround prior to patching, site administrators can disable the booking/add-to-cart functionality or restrict access to the booking form. Additionally, implement a web application firewall (WAF) rule to flag or block requests to mptbm_add_to_cart with anomalously low pricing values.

The vulnerability was discovered and reported by security researcher Muni Nitish Kumar Yaddala and verified by WPScan (WPScan). No significant broader media coverage or notable community commentary has been identified at this time.