CVE-2025-5947 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated attackers can bypass login checks via cookie manipulation in `service_finder_switch_back()`. <br>💥 **Consequences**: Full **Privilege Escalation**.…

🛡️ **Root Cause**: **CWE-639** (Authorization Bypass Through User-Controlled Key). <br>🔍 **Flaw**: The plugin fails to validate the user's cookie value before logging them in.…

📦 **Affected**: WordPress Plugin **Service Finder Bookings**. <br>📅 **Version**: **6.0 and earlier**. <br>🏢 **Vendor**: aonetheme. <br>🌐 **Context**: Popular booking/service management system for WordPress.

👑 **Privileges**: Gain **Admin Access**. <br>📂 **Data**: Read/Write/Modify ALL site data. <br>🔓 **Action**: Login as **ANY** user (Admin, Editor, Subscriber) without knowing their password.…

⚡ **Threshold**: **EXTREMELY LOW**. <br>🔑 **Auth**: None required (Unauthenticated). <br>🖱️ **UI**: None required (No user interaction needed). <br>🌐 **Network**: Remote (AV:N). <br>🎯 **Complexity**: Low (AC:L).

💣 **Public Exploit**: **YES**. <br>🔗 **Links**: <br>- [M4rgs/CVE-2025-5947_Exploit](https://github.com/M4rgs/CVE-2025-5947_Exploit) <br>- [NightlyAudit/CVE-2025-5947](https://github.com/NightlyAudit/CVE-2025-5947) <br>📡 …

🔍 **Self-Check**: Scan for these directory paths: <br>1. `/wp-content/plugins/service-finder/` <br>2. `/wp-content/plugins/service-finder-bookings/` <br>3.…

🩹 **Fix**: Update the plugin to the latest version released by **aonetheme**. <br>⚠️ **Note**: The vulnerability was published on **2025-08-01**.…

🚧 **Workaround (No Patch)**: <br>1. **Disable** the plugin immediately if not critical. <br>2. **Block** access to `/wp-admin/` via IP whitelist if possible. <br>3.…

🔥 **Priority**: **CRITICAL / URGENT**. <br>📉 **Risk**: CVSS **9.8** (Critical). <br>⏱️ **Action**: Patch **IMMEDIATELY**.…