Authentication Bypass Vulnerability in Service Finder SMS System Plugin for WordPress

CVE-2025-5955

What is CVE-2025-5955?

The Service Finder SMS System plugin for WordPress has a critical flaw that allows unauthenticated users to bypass authentication procedures and gain access to user accounts. The vulnerability stems from the plugin failing to verify phone numbers before granting access, enabling malicious actors to log in as any user without proper credentials. This security lapse affects all versions up to 2.0.0, posing a serious risk to the confidentiality and integrity of user data.

References