PT-2025-38515 · WordPress · Service Finder Bookings

Friderika Baranyai · Published 2025-09-19 · Updated 2025-09-20 · CVE-2025-5948

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Service Finder Bookings plugin for WordPress versions prior to 6.1

Description The Service Finder Bookings plugin for WordPress does not properly validate a user's identity prior to claiming a business when using the claim business API endpoint. This allows unauthenticated attackers to login as any user, including administrators. Subscriber privileges or brute-forcing are needed to complete the account takeover, and the claim id is required to takeover an admin account.

Recommendations Update to a version prior to 6.1.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-5948

Affected Products

Service Finder Bookings

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-5948 · Security Note
• https://t.me/cveNotify/135911 · Telegram Post
• https://twitter.com/CveFindCom/status/1968912872081084430 · Twitter Post
• https://twitter.com/CVEnew/status/1968923553438261665 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve · Note
• https://t.me/CVEtracker/32919 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968953905531830604 · Twitter Post
• https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 · Note
• https://twitter.com/offseq/status/1969348593719878129 · Twitter Post