CVE-2025-5947: WordPress Service Finder Privilege Escalation

CVE-2025-5947 Overview

The Service Finder Bookings plugin for WordPress contains a critical authentication bypass vulnerability that enables unauthenticated privilege escalation. The vulnerability exists in all versions up to and including 6.0, where the plugin fails to properly validate user cookie values before authenticating sessions through the service_finder_switch_back() function. This flaw allows remote attackers to bypass authentication controls and log in as any user on the affected WordPress site, including administrator accounts.

Critical Impact

Unauthenticated attackers can gain complete administrative access to WordPress sites running vulnerable versions of Service Finder Bookings, potentially leading to full site compromise, data theft, and malware deployment.

Affected Products

• Service Finder Bookings plugin for WordPress versions up to and including 6.0
• WordPress installations using Service Finder theme with bundled Bookings plugin
• Service Finder Service and Business Listing WordPress Theme ecosystem

Discovery Timeline

• 2025-08-01 - CVE-2025-5947 published to NVD
• 2025-10-23 - Last updated in NVD database

Technical Details for CVE-2025-5947

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), representing a fundamental flaw in how the Service Finder Bookings plugin handles user authentication state. The service_finder_switch_back() function is designed to facilitate user session management but lacks proper cryptographic validation of the cookie values it processes. When processing authentication requests, the function trusts user-supplied cookie data without verifying its authenticity or integrity, allowing attackers to craft malicious cookie values that impersonate legitimate users.

The network-accessible nature of this vulnerability, combined with no authentication requirements and no user interaction needed, creates an ideal attack surface for automated exploitation. An attacker can target any WordPress installation running the vulnerable plugin version without requiring any prior access or credentials.

Root Cause

The root cause stems from insecure direct object reference combined with missing authentication validation in the service_finder_switch_back() function. The plugin accepts user-controlled cookie values and uses them directly to establish authenticated sessions without cryptographically verifying the cookie's origin, validity, or association with a legitimate authentication event. This violates the principle of never trusting user-supplied input for security-critical operations.

Attack Vector

The attack is executed over the network by manipulating cookie values sent to the WordPress installation. An attacker identifies a target site running a vulnerable version of Service Finder Bookings, then crafts a malicious HTTP request containing specially constructed cookie values that reference an administrator user ID. When the service_finder_switch_back() function processes this request, it bypasses authentication checks and grants the attacker an authenticated session with the privileges of the impersonated user.

The exploitation requires no user interaction and can be performed by any unauthenticated remote attacker with network access to the target WordPress site. Once administrative access is obtained, attackers can modify site content, install malicious plugins, access sensitive data, create backdoor accounts, or pivot to attack the underlying server infrastructure.

Detection Methods for CVE-2025-5947

Indicators of Compromise

• Unexpected administrative sessions or login events from unknown IP addresses
• Anomalous HTTP requests targeting Service Finder plugin endpoints with manipulated cookie headers
• New administrator accounts created without legitimate authorization
• Modification of plugin files or theme components without authorized changes
• Web server logs showing repeated requests to service_finder_switch_back functionality

Detection Strategies

• Monitor WordPress authentication logs for logins that bypass standard wp-login.php flow
• Implement Web Application Firewall (WAF) rules to detect suspicious cookie manipulation patterns
• Review access logs for requests containing unusual cookie values targeting Service Finder endpoints
• Deploy file integrity monitoring on WordPress core files, plugins, and themes

Monitoring Recommendations

• Enable detailed WordPress audit logging to track all authentication events and administrative actions
• Configure real-time alerting for new administrator account creation or privilege changes
• Implement network-level monitoring for traffic patterns indicative of authentication bypass attempts
• Regularly audit user accounts and remove any suspicious or unauthorized administrator accounts

How to Mitigate CVE-2025-5947

Immediate Actions Required

• Update Service Finder Bookings plugin to a patched version beyond 6.0 immediately
• Audit all existing WordPress administrator accounts and remove any unauthorized users
• Review recent site activity and changes for signs of compromise
• Rotate all administrator credentials and invalidate existing sessions
• Implement IP-based access restrictions for WordPress administrative functions if feasible

Patch Information

Organizations should update to the latest version of the Service Finder Bookings plugin that addresses this vulnerability. Refer to the Wordfence CVE Vulnerability Report for detailed remediation guidance. The ThemeForest WordPress Theme Overview page provides information on obtaining updated plugin versions from the vendor.

For additional detection guidance, review the Vicarius Blog CVE-2025-5947 Detection resource, and for mitigation steps, consult the Vicarius Blog CVE-2025-5947 Mitigation article.

Workarounds

• Temporarily disable the Service Finder Bookings plugin until a patch can be applied
• Implement Web Application Firewall rules to block requests targeting the vulnerable service_finder_switch_back() function
• Restrict access to WordPress administrative endpoints at the network or web server level
• Enable multi-factor authentication for all WordPress administrator accounts as a defense-in-depth measure
• Consider temporarily taking affected sites offline if they contain sensitive data and cannot be immediately patched