{"id":76141,"date":"2025-09-25T15:17:39","date_gmt":"2025-09-25T15:17:39","guid":{"rendered":""},"modified":"2025-11-02T15:07:59","modified_gmt":"2025-11-02T21:07:59","slug":"cve-2025-5948-privilege-escalation-vulnerability-in-service-finder-bookings-plugin-for-wordpress","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-5948-privilege-escalation-vulnerability-in-service-finder-bookings-plugin-for-wordpress\/","title":{"rendered":"CVE-2025-5948: Privilege Escalation Vulnerability in Service Finder Bookings Plugin for WordPress<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-5948 vulnerability is a critical security flaw discovered in the Service Finder Bookings plugin for WordPress. This vulnerability allows for privilege escalation via account takeover, affecting all versions of the plugin up to and including 6.0. The flaw matters significantly as it allows for unauthenticated attackers to potentially login as any user, including admins, potentially leading to system<\/a> compromise or data leakage.
\nThis vulnerability specifically affects WordPress sites utilizing the Service Finder Bookings plugin<\/a> and has the potential to impact millions of businesses globally that depend on this platform for their online presence. Given the potential severity of this vulnerability<\/a>, it’s crucial for any organization utilizing this plugin to take immediate steps to address this risk.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-5948
\nSeverity: Critical (9.8 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: Low (Subscriber privileges)
\nUser Interaction: None
\nImpact: System compromise<\/a> or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Service Finder Bookings Plugin for WordPress<\/a> | Up to and including 6.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of the plugin’s lack of proper user<\/a> identity validation before claiming a business using the claim_business AJAX action. This lack of validation makes it possible for an unauthenticated attacker to log in as any user<\/a>, including admins.
\nTo complete the business takeover, the attacker would need subscriber privileges or to brute-force valid IDs. The claim_id is required to takeover the admin account<\/a>, but brute-forcing is a practical approach to obtaining valid IDs.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An example of exploiting this vulnerability might look like the following pseudocode:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=claim_business HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\n{ \"claim_id\": \"brute_force or known_valid_id\", \"user\": \"admin\" }<\/code><\/pre>\n
In this example, the attacker is sending a POST request to the vulnerable<\/a> endpoint, using either a brute-forced or known valid claim_id, and attempting to gain access as the ‘admin’ user.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
Given the potential severity of this vulnerability<\/a>, it’s recommended to apply the vendor patch as soon as it becomes available. In the meantime, employing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation, reducing the risk of a successful exploit.
\nRemember to always keep your WordPress plugins<\/a> up-to-date and monitor your systems for any unusual or suspicious activity. Regular penetration testing and vulnerability<\/a> assessments can further help identify and mitigate such vulnerabilities before they are exploited.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-5948 vulnerability is a critical security flaw discovered in the Service Finder Bookings plugin for WordPress. This vulnerability allows for privilege escalation via account takeover, affecting all versions of the plugin up to and including 6.0. The flaw matters significantly as it allows for unauthenticated attackers to potentially login as any user, including […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[76],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-76141","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-privilege-escalation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t