E-cab Taxi Booking Manager for Woocommerce Security & Risk Analysis

The "ecab-taxi-booking-manager" plugin version 2.0.2 exhibits a concerning security posture, despite some positive indicators. While a significant portion of SQL queries and output operations are properly handled, the presence of 20 unprotected AJAX handlers represents a substantial attack surface that could be exploited by unauthenticated users. The static analysis also flags two instances of the dangerous `unserialize` function, a known vector for deserialization vulnerabilities, and the taint analysis reveals two high-severity flows with unsanitized paths, indicating potential for serious compromise. The plugin's vulnerability history is particularly alarming, with four known CVEs including one critical and one high severity. The fact that the last vulnerability was identified in August 2025 (presumably a typo and meant to be in the past, but still indicating recent past issues) and that the common vulnerability types include missing authorization, deserialization of untrusted data, and XSS, paints a picture of recurring and severe security flaws. While the use of prepared statements and proper output escaping are strengths, the numerous unprotected entry points, dangerous function usage, critical taint flows, and persistent vulnerability history heavily outweigh these positives, suggesting a high-risk plugin requiring immediate attention and remediation.