PT-2025-31598 · WordPress · Service Finder Bookings

Friderika Baranyai

·

Published

2025-07-31

·

Updated

2026-02-05

·

CVE-2025-5947

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Service Finder Bookings plugin for WordPress versions up to and including 6.0
Description The Service Finder Bookings plugin for WordPress is susceptible to a privilege escalation issue due to an authentication bypass. This occurs because the plugin does not properly validate a user's cookie value before granting access through the service finder switch back() function. This allows unauthenticated attackers to log in as any user, including administrators. Over 13,800 exploit attempts have been recorded since August, indicating active exploitation of this issue. The vulnerability allows attackers to bypass authentication and gain unauthorized access to any account, including administrator accounts, potentially leading to the seizure of control, injection of malicious code, redirection to phishing pages, or hosting of malware.
Recommendations Update to Service Finder Bookings version 6.1 to address this vulnerability.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2025-13638
CVE-2025-5947

Affected Products

Service Finder Bookings