CVE-2025-5947

Published Aug 1, 2025

Last updated 4 months ago

WordPress

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-5947 is a critical authentication bypass vulnerability affecting the Service Finder WordPress theme, specifically the Service Finder Bookings plugin. This vulnerability stems from the plugin's improper validation of the `original_user_id` cookie within the `service_finder_switch_back()` function. Versions 6.0 and older are affected. Successful exploitation of CVE-2025-5947 allows unauthenticated attackers to log in as any user, including administrators. This can lead to attackers modifying website content, injecting malicious code, stealing sensitive data, and compromising the server. The vulnerability was patched in version 6.1, released on July 17, 2025.

Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-639

Hype score: Not currently trending

References