CVE-2025-5949: Service Finder Bookings Privilege Escalation

CVE-2025-5949 Overview

CVE-2025-5949 is a privilege escalation vulnerability in the Service Finder Bookings plugin for WordPress, affecting all versions up to and including 6.0. The plugin fails to validate a user's identity before processing password change requests. Authenticated attackers with subscriber-level access or higher can reset passwords for any account, including administrators. Successful exploitation results in full account takeover and complete compromise of the affected WordPress site. The flaw is categorized under CWE-639, Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated subscriber can reset an administrator password, take over the admin account, and gain full control of the WordPress site.

Affected Products

Service Finder Bookings plugin for WordPress (all versions ≤ 6.0)
WordPress sites using the Service Finder theme from ThemeForest
Bundled installations of the Service Finder Service and Business Listing theme

Discovery Timeline

2025-11-01 - CVE-2025-5949 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5949

Vulnerability Analysis

The Service Finder Bookings plugin exposes a password change endpoint that processes change requests without verifying the requester owns the target account. The handler accepts a user identifier supplied in the request and updates the corresponding password without checking the current session against that identifier, and without requiring the existing password or a valid one-time reset token.

Because WordPress authentication state is decoupled from the password change parameter, an authenticated subscriber can supply the user ID of any account, including an administrator, and overwrite that account's password. Once the password is changed, the attacker logs in as that user and inherits all assigned capabilities.

Root Cause

The root cause is missing authorization on a sensitive state-changing action, mapped to CWE-639. The plugin trusts a user-controlled identifier rather than deriving the target account from the authenticated session. No capability check, nonce-bound identity check, or current-password verification is enforced before the password update is committed.

Attack Vector

Exploitation is performed remotely over the network by any authenticated user. WordPress sites that allow open registration grant subscriber access by default, lowering the barrier to exploitation. The attacker submits a crafted request to the vulnerable password change action, specifying the administrator's user ID and a new password. After the request succeeds, the attacker authenticates as the administrator and executes arbitrary administrative actions including plugin installation, theme modification, and PHP code execution through the editor.

No public proof-of-concept was listed in the enriched data at publication. Technical context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-5949

Indicators of Compromise

Unexpected password change events for administrator or editor accounts in WordPress user metadata or audit logs.
Subscriber accounts authenticating shortly before an administrator login from the same IP address or user agent.
New administrator accounts, modified plugins, or theme file edits following a password change event.
HTTP POST requests to Service Finder Bookings AJAX or REST endpoints containing a user_id parameter not matching the session owner.

Detection Strategies

Monitor WordPress authentication logs for password resets that are not preceded by a matching retrieve_password or email-based reset workflow.
Alert on any password change request where the acting user has the subscriber role but the modified user has elevated privileges.
Inspect web server access logs for repeated requests to Service Finder Bookings handlers originating from low-privilege sessions.

Monitoring Recommendations

Enable a WordPress activity log plugin that records user role, source IP, and target user for every password change.
Forward web server and WordPress audit events to a centralized logging platform and apply correlation rules against the indicators above.
Track plugin and theme file modification timestamps to surface follow-on activity after a suspected takeover.

How to Mitigate CVE-2025-5949

Immediate Actions Required

Update the Service Finder Bookings plugin to a version later than 6.0 that addresses CVE-2025-5949 as soon as the vendor releases a patch.
Disable or remove the Service Finder Bookings plugin on sites that cannot be updated immediately.
Force a password reset for all administrator and editor accounts and rotate any associated API keys or application passwords.
Audit the user table for unauthorized accounts and recently changed passwords, and review installed plugins and theme files for unauthorized modifications.

Patch Information

No fixed version is listed in the enriched CVE data. Site operators should consult the ThemeForest product page and the Wordfence Vulnerability Report for the latest vendor guidance and patched release.

Workarounds

Disable user self-registration in WordPress settings to remove the default path to subscriber access.
Restrict access to wp-admin and the plugin's AJAX or REST endpoints with a Web Application Firewall (WAF) rule that blocks unauthenticated and low-privilege requests.
Deactivate the Service Finder Bookings plugin until a fixed version is installed.
Enforce multi-factor authentication for administrator accounts so that a stolen password alone does not yield account access.

bash

# Example WAF rule (ModSecurity) blocking subscriber-initiated password changes to the plugin endpoint
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1005949,msg:'Block Service Finder Bookings password change (CVE-2025-5949)'"
  SecRule ARGS:action "@rx service_finder_(sub_)?change_password" \
    "chain"
    SecRule ARGS:user_id "!@streq %{SESSION.user_id}"