Privilege Escalation in Service Finder Bookings Plugin by WordPress

CVE-2025-5948

What is CVE-2025-5948?

The Service Finder Bookings plugin for WordPress is susceptible to a privilege escalation vulnerability that allows unauthenticated attackers to claim business accounts through the claim_business AJAX action. This flaw arises from insufficient user identity validation, enabling attackers to impersonate any user, including administrators, provided they can obtain a valid claim_id. The process may require brute-forcing or similar methods to gain access to subscriber privileges, making it a considerable security risk for WordPress users.

References