CVE-2026-27345

CVE-2026-27345 is a broken access control vulnerability in a WooCommerce taxi and fleet booking extension. An unauthenticated attacker can enumerate customer names, phone numbers, pickup and dropoff locations, and potentially payment data through a REST endpoint or AJAX handler that lacks a capability check. This is not a novel vulnerability — it belongs to a well-documented family of WordPress plugin CVEs where developers register API endpoints without a `permission_callback` or equivalent authentication gate. The exploit path is straightforward: identify the plugin, locate the unauthenticated endpoint (typically `/wp-json/` or a wp-admin AJAX handler), and query it directly to retrieve booking records. No authentication, no prior access, no user interaction required. The vulnerable code likely shipped this way from the start — a developer tested the booking flow authenticated as an admin, never probing the unauthenticated attack surface, and WordPress provides no friction or warning when you register an endpoint without capability checks. What makes this CVE distinct from a typical plugin vulnerability is the data sensitivity. Taxi booking systems handle daily movement patterns of identifiable people — not abstract PII, but physical location trails that can be leveraged for stalking, social engineering, or targeted theft. The CVSS score likely doesn't capture this dimension. If you're running this plugin, treat the compromise scenario as a physical safety issue, not just a data breach. Defenders should: audit your WordPress installation for any booking, reservation, or fleet management plugins from the WooCommerce marketplace and verify that all REST API endpoints and AJAX handlers require authentication — look for `permission_callback` callbacks that call `current_user_can()` or WooCommerce's permission functions; check server access logs for repeated GET or POST requests to `/wp-json/` paths associated with this plugin before the CVE was published, which would indicate silent enumeration; and assume the vulnerability was actively exploitable for months or years before disclosure, given the pattern of abandoned plugin code in the WooCommerce ecosystem. The broader lesson is that WordPress's permission model subsidizes insecure endpoints — omitting authentication costs nothing, while the cost of exploitation falls on someone else. If you maintain WooCommerce extensions, treat every endpoint as public unless you've explicitly secured it. If you run plugins that handle booking or location data, monitor for unexpected access patterns and consider disabling the REST API entirely if your plugin doesn't need it.

Reviewed through automated stages and approved by a human before publication.