CVE-2025-5947

Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.

Affected

aonetheme · Service Finder Bookings

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.51% chance of exploitation in the next 30 days, 91st percentile

Nuclei

critical · CWE-639

Published

2025-08-01

Updated

2026-04-08

Proof-of-concept exploits (1)

• xxconi/CVE-2025-59470★ · 2026-05-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5947.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-13407
• CVE-2025-6254
• CVE-2026-10735
• CVE-2026-12415
• CVE-2026-12416
• CVE-2026-22356