Privilege Escalation in Service Finder Bookings Plugin by WordPress

CVE-2025-5948

What is CVE-2025-5948?

The Service Finder Bookings plugin for WordPress is susceptible to a privilege escalation vulnerability that allows unauthenticated attackers to claim business accounts through the claim_business AJAX action. This flaw arises from insufficient user identity validation, enabling attackers to impersonate any user, including administrators, provided they can obtain a valid claim_id. The process may require brute-forcing or similar methods to gain access to subscriber privileges, making it a considerable security risk for WordPress users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References