PT-2025-31596 · WordPress · Service Finder Sms System

Friderika Baranyai · Published 2025-08-01 · Updated 2025-08-06 · CVE-2025-5954

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Service Finder SMS System plugin for WordPress versions prior to 2.0.1

Description The Service Finder SMS System plugin for WordPress is susceptible to privilege escalation, allowing unauthenticated attackers to register as administrator users. This is due to the plugin’s failure to restrict user role selection during registration through the aonesms fn savedata after signup() function.

Recommendations Update to version 2.0.1 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-5954

Affected Products

Service Finder Sms System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-5954 · Security Note
• https://twitter.com/VulmonFeeds/status/1951122046286536880 · Twitter Post
• https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 · Note
• https://twitter.com/cracbot/status/1953048446589407739 · Twitter Post
• https://twitter.com/CVEnew/status/1951123435830034847 · Twitter Post
• https://t.me/CVEtracker/28905 · Telegram Post
• https://t.me/cveNotify/130499 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve · Note
• https://twitter.com/offseq/status/1951115777655951675 · Twitter Post