Privilege Escalation Vulnerability in Service Finder Bookings Plugin for WordPress

CVE-2025-6574

What is CVE-2025-6574?

The Service Finder Bookings plugin for WordPress contains a vulnerability that allows authenticated attackers with minimal access to escalate their privileges. This occurs when the plugin fails to properly validate user identities before allowing changes to their account details, specifically email addresses. As a result, an attacker with subscriber-level access can manipulate a user’s email address, including that of an administrator. This manipulation enables the attacker to initiate a password reset, potentially gaining unauthorized access to the targeted user’s account. Site administrators should ensure they are using the latest version of the plugin to mitigate this risk.

References