Read the docs
TI-2025-05972 Aliases CVE-2025-6574GHSA-rh5q-2gvc-hr3m

Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

Priority MEDIUM 40CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix Fixed Service Finder Bookings (aonetheme): 6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aonethemeService Finder Bookingsbefore 6.16.1Patch availableCNA
  • Service Finder Bookings Vendoraonetheme Affected before 6.1 Fixed in 6.1 Patch available CNA

Remediation

  • Fix · CNA Service Finder Bookings (aonetheme) Fixed in 6.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-6574
  2. 2026-10-03 Alias added: GHSA-rh5q-2gvc-hr3m

References

Other 2

  • TI-2025-05372 Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie CVSS 3.1CRITICAL 9.8
  • TI-2025-17737 WordPress Service Finder Booking plugin <= 6.1 - Privilege Escalation Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-05373 Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business CVSS 3.1CRITICAL 9.8
  • TI-2025-02145 Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input' CVSS 3.1CRITICAL 9.8
  • TI-2024-12483 Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-05378 Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences