CVE-2025-5947

The vulnerability in the Service Finder Bookings plugin for WordPress arises from an inadequate validation process of user cookie values during the authentication phase. Specifically, the flaw is located within the service_finder_switch_back() function, which fails to ensure that the cookie value is legitimate before allowing a user to log in. This oversight permits unauthenticated attackers to bypass normal authentication mechanisms and gain access to user accounts, including those with administrative privileges. The severity of this vulnerability is underscored by its high CVSS score of 9.8, indicating a critical risk that could lead to unauthorized access and potential system compromise.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could craft a malicious request that manipulates the cookie value, effectively tricking the system into believing the attacker is a legitimate user. This could be executed through common web exploitation techniques, such as session hijacking or cross-site scripting (XSS). Once the attacker successfully logs in as a user, they could escalate their privileges to that of an administrator, granting them unfettered access to the WordPress site. This access could be leveraged to modify site content, install malicious plugins, or exfiltrate sensitive user data, thereby amplifying the impact of the initial breach.

The real-world implications of this vulnerability are significant, particularly for organizations that rely on the Service Finder Bookings plugin for their operations. A successful exploitation could lead to severe business risks, including data breaches, loss of customer trust, and potential regulatory penalties. For instance, if an attacker were to gain administrative access, they could manipulate booking data, disrupt service availability, or even deploy ransomware. The financial repercussions could be substantial, not only from immediate remediation costs but also from long-term reputational damage and loss of customer loyalty.

To detect and mitigate this vulnerability, organizations should implement a multi-faceted approach. First, it is crucial to monitor user authentication logs for any unusual activity that may indicate exploitation attempts, such as multiple failed login attempts or logins from unexpected IP addresses. Additionally, organizations should ensure that they are using the latest version of the Service Finder Bookings plugin, as updates often include critical security patches. Furthermore, employing web application firewalls (WAFs) can help filter out malicious requests before they reach the application layer. Lastly, conducting regular security audits and penetration testing can proactively identify and remediate vulnerabilities before they can be exploited by attackers.

In conclusion, the privilege escalation vulnerability within the Service Finder Bookings plugin poses a serious threat to WordPress installations. Its ability to allow unauthenticated access to user accounts, including those with administrative privileges, can lead to significant operational and reputational damage. Organizations must prioritize the detection and mitigation of such vulnerabilities to safeguard their digital assets and maintain the integrity of their services. By adopting a comprehensive security strategy that includes timely updates, vigilant monitoring, and proactive testing, businesses can better protect themselves against the evolving landscape of cyber threats.

CSURFACE threat intelligence has identified a marked escalation in exploitation activity targeting CVE-2025-5947, driven by the emergence of publicly available proof-of-concept exploit code on GitHub. This development has broadened the exploit landscape, lowering the technical barrier for threat actors to conduct privilege escalation attacks via the vulnerable Service Finder Bookings plugin. Our telemetry indicates a significant uptick in detection events consistent with attempts to leverage this vulnerability, accompanied by a rising Exploit Prediction Scoring System (EPSS) score that now places this CVE in the upper percentile of likely exploitation. The availability of exploit code in the public domain substantially increases the risk of widespread abuse, particularly by less sophisticated adversaries who can now weaponize the vulnerability without extensive custom development. Consequently, the threat level associated with CVE-2025-5947 has intensified, underscoring an urgent need for heightened vigilance among defenders monitoring WordPress environments using this plugin.

Update 2 — June 19, 2026

CSURFACE threat intelligence has detected a marked escalation in detection activity related to CVE-2025-5947, indicating increased adversary interest or scanning efforts targeting the Service Finder Bookings plugin. Despite this surge in telemetry, the Exploit Prediction Scoring System (EPSS) score has sharply declined, reflecting a reduced likelihood of widespread exploitation in the immediate term. This divergence suggests that while reconnaissance or probing attempts are rising, successful exploitation or weaponization may be encountering operational challenges or diminished attacker prioritization. The availability of public proof-of-concept exploit code remains a critical factor sustaining baseline risk, but the current telemetry implies a potential cooling in active exploitation campaigns. For defenders, this nuanced shift underscores the importance of maintaining vigilant monitoring to detect any transition from increased scanning to active compromise attempts. Overall, the threat level remains elevated due to the vulnerability’s critical nature and exploit accessibility, but the recent telemetry trends moderate the urgency of imminent large-scale exploitation.