PT-2025-38510 · WordPress · Service Finder Sms System

Friderika Baranyai · Published 2025-09-19 · Updated 2025-09-19 · CVE-2025-5955

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Service Finder SMS System plugin for WordPress versions prior to 2.1.0

Description The Service Finder SMS System plugin for WordPress does not verify a user's phone number before logging them in, leading to authentication bypass. This allows unauthenticated attackers to log in as arbitrary users.

Recommendations Update the Service Finder SMS System plugin to version 2.1.0 or later.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-5955

Affected Products

Service Finder Sms System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-5955 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cc4598a7-d5cf-4553-b29a-659fe288ece9?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1968966702722388078 · Twitter Post
• https://t.me/CVEtracker/32915 · Telegram Post
• https://twitter.com/CVEnew/status/1968923558953750999 · Twitter Post
• https://t.me/cveNotify/135907 · Telegram Post
• https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 · Note