Cyber Resilience

CVE-2025-24661

HighRCE

Published: 03 February 2025

Published
03 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 24.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-24661 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-24661 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Taxi Booking Manager for WooCommerce WordPress plugin (ecab-taxi-booking-manager) from magepeopleteam. The flaw enables Object Injection and affects all versions from n/a through 1.1.8, as published on 2025-02-03.

Attackers with low privileges, such as authenticated WordPress users, can exploit this over the network with low attack complexity and no user interaction required. The CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impacts, potentially allowing full compromise of confidentiality, integrity, and availability on affected systems.

The Patchstack advisory provides further details on this PHP Object Injection vulnerability in version 1.1.8 of the plugin.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

The PHP deserialization/object injection vulnerability in the public-facing WordPress plugin allows low-privileged authenticated attackers to achieve remote code execution and full system compromise over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-54007Shared CWE-502
CVE-2025-60215Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2025-49869Shared CWE-502
CVE-2026-27379Shared CWE-502
CVE-2026-27338Shared CWE-502
CVE-2026-33858Shared CWE-502
CVE-2026-6857Shared CWE-502
CVE-2025-36072Shared CWE-502
CVE-2025-64266Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2025-24661 by requiring timely patching of the deserialization of untrusted data flaw in the Taxi Booking Manager for WooCommerce plugin versions <=1.1.8.

SI-10 Information Input Validation good match
prevent

Prevents object injection exploitation in the plugin by validating untrusted data inputs prior to deserialization processing.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Identifies the presence of the vulnerable Taxi Booking Manager plugin through regular vulnerability scanning, enabling remediation.

References