What’s Vulnerable › Vulnerabilities

CVE-2022-1391: Cab fare calculator < 1.0.4 - Unauthenticated LFI

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-25 · updated 2026-06-17
• Weakness: CWE-22

Description

The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.

Affected products

• Cab fare calculator: before 1.0.4 — fixed in 1.0.4

How to fix

Upgrade to a fixed version: Cab fare calculator 1.0.4. Check the vendor advisory for mitigations.

References

• https://packetstormsecurity.com/files/166533/
• https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac
• https://packetstormsecurity.com/files/166533/
• https://wpscan.com/vulnerability/680121fe-6668-4c1a-a30d-e70dd9be5aac

Get alerted when CVE-2022-1391 or the next vulnerability affects your stack