Privilege Escalation Vulnerability in Service Finder Bookings Plugin for WordPress
CVE-2025-2470

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Service Finder Bookings
Vendor
CVE Published:
25 April 2025

What is CVE-2025-2470?

The Service Finder Bookings plugin for WordPress is vulnerable due to insufficient restrictions on user roles within the 'nsl_registration_store_extra_input' function. This oversight allows an unauthenticated attacker to exploit social login functionality to create an account with any role, including Administrator. The vulnerability requires the Nextend Social Login plugin to be installed and properly configured to enable exploitation. This flaw poses severe risks to WordPress sites using the affected versions, as it could lead to unauthorized access and potential site control.

Affected Version(s)

Service Finder Bookings * <= 5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/service-finder-service-and-b...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alyudin Nafiie
.