PT-2025-31596 · WordPress · Service Finder Sms System

Friderika Baranyai · Publicado 2025-08-01 · Atualizado 2025-08-06 · CVE-2025-5954

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Service Finder SMS System plugin for WordPress versions prior to 2.0.1

Description The Service Finder SMS System plugin for WordPress is susceptible to privilege escalation, allowing unauthenticated attackers to register as administrator users. This is due to the plugin’s failure to restrict user role selection during registration through the aonesms fn savedata after signup() function.

Recommendations Update to version 2.0.1 or later.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-5954

Produtos afetados

Service Finder Sms System

Referências · 9

• https://twitter.com/VulmonFeeds/status/1951122046286536880 · Publicação no Twitter
• https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 · Nota
• https://twitter.com/cracbot/status/1953048446589407739 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1951123435830034847 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-5954 · Nota de Segurança
• https://t.me/CVEtracker/28905 · Publicação no Telegram
• https://t.me/cveNotify/130499 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve · Nota
• https://twitter.com/offseq/status/1951115777655951675 · Publicação no Twitter