CVE-2025-5947

{"id": "CVE-2025-5947", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-08-01T04:16:21.693", "references": [{"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fe4f60-d93b-4071-90ae-ac863c17fe19?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins."}, {"lang": "es", "value": "El complemento Service Finder Bookings para WordPress es vulnerable a la escalada de privilegios mediante la omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 6.0 incluida. Esto se debe a que el plugin no valida correctamente el valor de la cookie del usuario antes de iniciar sesi\u00f3n mediante la funci\u00f3n service_finder_switch_back(). Esto permite que atacantes no autenticados inicien sesi\u00f3n como cualquier usuario, incluidos los administradores."}], "lastModified": "2025-08-04T15:06:15.833", "sourceIdentifier": "security@wordfence.com"}