Critical Exploit Lets Hackers Bypass Authentication in Word Press Service Finder Theme

Summary: Threat actors are actively exploiting CVE-2025-5947, a 9.8-severity authentication bypass in the Service Finder Bookings plugin bundled with the Service Finder WordPress theme, allowing an unauthenticated attacker to sign in as any user, including administrators. The flaw, found by researcher Foxyyy and described by Wordfence's István Márton, stems from the plugin not validating a user's cookie value in its account switching function (service_finder_switch_back()), affects all versions up to and including 6.0, and was patched on July 17, 2025 in version 6.1.
What you should know: Wordfence has logged over 13,800 exploitation attempts since August 1, 2025 against a theme sold to more than 6,100 customers, and a single successful request hands an attacker administrator control of the site.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-5947
Related: ⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026