CVE-2025-5955: WordPress Service Finder Auth Bypass Flaw

CVE-2025-5955 Overview

The Service Finder SMS System plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 2.0.0. The vulnerability stems from a fundamental flaw in the plugin's authentication mechanism—specifically, the plugin fails to properly verify a user's phone number before granting authentication. This authentication weakness allows unauthenticated attackers to log in as any arbitrary user on the WordPress site, potentially gaining administrative access.

Critical Impact

Unauthenticated attackers can bypass authentication and impersonate any user, including administrators, leading to complete site compromise.

Affected Products

• Service Finder SMS System WordPress Plugin versions ≤ 2.0.0
• WordPress sites using the Service Finder theme with SMS authentication
• Service Finder Service and Business Listing WordPress Theme

Discovery Timeline

• 2025-09-19 - CVE-2025-5955 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5955

Vulnerability Analysis

This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The core issue lies in the SMS-based authentication workflow implemented by the Service Finder SMS System plugin. When users attempt to authenticate via phone number verification, the plugin fails to perform adequate validation of the phone number ownership before establishing an authenticated session.

The authentication mechanism appears to accept phone number claims without verifying that the requesting user actually controls or has access to the specified phone number. This creates a direct path for attackers to impersonate legitimate users by simply providing their phone numbers during the login process.

The network-accessible attack vector means remote attackers can exploit this vulnerability without any prior authentication or privileges on the target system. The impact spans confidentiality, integrity, and availability of the affected WordPress installations.

Root Cause

The root cause is improper implementation of the phone number verification workflow within the plugin's authentication logic. The plugin appears to trust user-supplied phone number input without implementing proper verification challenges (such as SMS code verification or out-of-band confirmation). This violates secure authentication principles that require proof of identity before granting access.

Attack Vector

The vulnerability is exploitable over the network by unauthenticated attackers. An attacker can craft requests to the plugin's authentication endpoints, supplying a target user's phone number. Due to the missing verification step, the plugin authenticates the attacker as the victim user. This attack requires no user interaction and can be automated to target multiple accounts.

The attacker would need to know or enumerate valid phone numbers associated with user accounts on the target WordPress site. Once authenticated as a victim user, the attacker inherits all privileges of that account, including administrative capabilities if an admin account is compromised.

Detection Methods for CVE-2025-5955

Indicators of Compromise

• Unusual login patterns showing authentication without corresponding SMS verification requests
• Multiple accounts being accessed from the same IP address in rapid succession
• Authentication logs showing successful logins without prior OTP validation steps
• Administrative actions performed by accounts that typically have limited activity

Detection Strategies

• Monitor WordPress authentication logs for anomalous login patterns, particularly SMS-based authentications
• Implement rate limiting and alerting on authentication endpoints associated with the Service Finder SMS System plugin
• Review access logs for the plugin's authentication endpoints for suspicious request patterns
• Deploy Web Application Firewall (WAF) rules to detect and block authentication bypass attempts

Monitoring Recommendations

• Enable verbose logging on WordPress authentication events and correlate with SMS gateway logs
• Set up alerts for administrative account logins, especially during off-hours or from unusual geographic locations
• Monitor for unauthorized changes to user permissions or plugin settings
• Review and audit user sessions regularly for unexpected active sessions

How to Mitigate CVE-2025-5955

Immediate Actions Required

• Immediately disable or deactivate the Service Finder SMS System plugin until a patched version is available
• Audit all user accounts for signs of unauthorized access or compromise
• Force password resets and session invalidation for all users, especially administrators
• Implement additional authentication factors that don't rely on the vulnerable plugin
• Review WordPress activity logs for evidence of exploitation

Patch Information

At the time of publication, organizations should check with the plugin vendor for an updated version that addresses this authentication bypass vulnerability. The ThemeForest Item Overview page should be monitored for security updates. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable SMS-based authentication entirely and use alternative authentication methods
• Implement IP-based access restrictions for administrative functions
• Deploy a Web Application Firewall with rules to block suspicious authentication requests to the plugin endpoints
• Consider implementing additional WordPress security plugins that provide authentication hardening

# WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate service-finder-sms-system --path=/var/www/html

# Force logout all users to invalidate potentially compromised sessions
wp user session destroy --all --path=/var/www/html

# Review recent authentication activity
wp user list --role=administrator --fields=ID,user_login,user_registered --path=/var/www/html