A critical authentication bypass vulnerability in the Service Finder Bookings WordPress plugin has been actively exploited in the wild, allowing unauthenticated attackers to gain full administrator privileges.
Tracked as CVE-2025-5947, the flaw affects all versions up to and including 6.0 and received a CVSS score of 9.8 (Critical). Following public disclosure on July 31, 2025, exploit attempts surged the very next day, with the Wordfence Firewall blocking over 13,800 malicious requests to date.
Vulnerability Summary and Attack Vector
The Service Finder Bookings plugin implements account switching via the service_finder_switch_back() function, intended to restore an original user’s session after impersonation.
Due to missing authorization checks, the function processes a specially crafted cookie, original_user_id, without validating its value.
An attacker needs only to issue a GET request /?switch_back=1 with Cookie: original_user_id=1; to assume the identity of the user associated with ID 1, which is often the administrator account. This bypasses all authentication controls and grants full administrative rights.
Upon receiving this request, the plugin immediately logs the attacker in as the targeted user. No additional credentials or tokens are required.
Exploitation Activity and Indicators of Compromise
Exploit attempts began on August 1, 2025, and steadily increased, with a sharp spike observed from September 22 to September 29.
The Wordfence Firewall rule, deployed to Premium, Care, and Response subscribers on June 13, 2025 (and to free users on July 13, 2025), inspects the original_user_id cookie and blocks any unauthorized requests before they can succeed. The rule has prevented over 13,800 attempts to exploit this flaw.
Top offending IP addresses by blocked requests:
| IP Address | Blocked Requests |
|---|---|
| 5.189.221.98 | 2,700+ |
| 185.109.21.157 | 2,600+ |
| 192.121.16.196 | 2,600+ |
| 194.68.32.71 | 2,300+ |
| 178.125.204.198 | 1,400+ |
The absence of additional malware indicators means compromise may go undetected if logs are cleared. Administrators should search server access logs for any requests containing the switch_back parameter and review user sessions for anomalies.
Service Finder Bookings version 6.1, released July 17, 2025, patches this issue by enforcing authorization checks before processing account switch requests.
Site owners must update vulnerable installations immediately. Running outdated versions leaves sites vulnerable to trivial account takeover attacks, potentially leading to complete site compromise.
WordPress administrators are advised to:
- Upgrade the Service Finder Bookings plugin to version 6.1 or later.
- Audit server logs for GET requests to
/?switch_back=1and corresponding cookie activity. - Rotate administrator passwords and invalidate existing sessions.
- Harden WordPress installations by limiting plugin use to trusted, actively maintained extensions.
This vulnerability underscores the risk of bypassable cookie-based authentication mechanisms in plugin functionality. Ensuring strict validation of user-controlled inputs is essential to prevent privilege escalation.
Organizations without automated firewall defenses should consider deploying a Web Application Firewall to detect and block exploitation attempts in real time.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
