Cyber Posture

CVE-2025-24661

HighRCE

Published: 03 February 2025

Published
03 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 24.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24661 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2025-24661 by requiring timely patching of the deserialization of untrusted data flaw in the Taxi Booking Manager for WooCommerce plugin versions <=1.1.8.

SI-10 Information Input Validation good match
prevent

Prevents object injection exploitation in the plugin by validating untrusted data inputs prior to deserialization processing.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Identifies the presence of the vulnerable Taxi Booking Manager plugin through regular vulnerability scanning, enabling remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

The PHP deserialization/object injection vulnerability in the public-facing WordPress plugin allows low-privileged authenticated attackers to achieve remote code execution and full system compromise over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.

Deeper analysisAI

CVE-2025-24661 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Taxi Booking Manager for WooCommerce WordPress plugin (ecab-taxi-booking-manager) from magepeopleteam. The flaw enables Object Injection and affects all versions from n/a through 1.1.8, as published on 2025-02-03.

Attackers with low privileges, such as authenticated WordPress users, can exploit this over the network with low attack complexity and no user interaction required. The CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impacts, potentially allowing full compromise of confidentiality, integrity, and availability on affected systems.

The Patchstack advisory provides further details on this PHP Object Injection vulnerability in version 1.1.8 of the plugin.

Details

CWE(s)
CWE-502

CVEs Like This One

CVE-2026-24954Shared CWE-502
CVE-2026-27685Shared CWE-502
CVE-2025-14476Shared CWE-502
CVE-2025-60215Shared CWE-502
CVE-2025-36072Shared CWE-502
CVE-2025-59245Shared CWE-502
CVE-2026-22346Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2026-24981Shared CWE-502
CVE-2025-50004Shared CWE-502

References