PT-2025-44719 · WordPress · Service Finder Bookings

Thái An · Published 2025-11-01 · Updated 2025-11-01 · CVE-2025-6574

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Service Finder Bookings plugin for WordPress versions prior to 6.1

Description The Service Finder Bookings plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. This occurs because the plugin does not adequately verify a user’s identity before allowing updates to user details, such as their email address. Authenticated attackers with subscriber-level access or higher can modify the email addresses of any user, including administrators. This allows attackers to initiate password resets and gain unauthorized access to accounts.

Recommendations Versions prior to 6.1 should be updated to version 6.1 or later to address this issue.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-6574

Affected Products

Service Finder Bookings

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6574 · Security Note
• https://twitter.com/CVEnew/status/1984514503610974511 · Twitter Post
• https://t.me/CVEtracker/36375 · Telegram Post
• https://twitter.com/RedPacketSec/status/1984563399066276191 · Twitter Post
• https://twitter.com/CveFindCom/status/1984540939256279452 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1984528913029030347 · Twitter Post
• https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 · Note
• https://t.me/cveNotify/141248 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=cve · Note