CVE-2025-2470

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2470", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-17T17:35:16.136Z", "datePublished": "2025-04-25T11:12:53.066Z", "dateUpdated": "2026-04-08T17:12:32.520Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:32.520Z"}, "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability."}], "title": "Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f62cda-262b-46d9-a839-0a573813cfa1?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-266 Incorrect Privilege Assignment", "cweId": "CWE-266", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "timeline": [{"time": "2025-04-24T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-25T11:57:33.774415Z", "id": "CVE-2025-2470", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T11:57:50.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-25T11:57:33.774415Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-25T11:57:46.272Z"}}], "cna": {"title": "Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'", "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-24T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f62cda-262b-46d9-a839-0a573813cfa1?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:32.520Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2470", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:32.520Z", "dateReserved": "2025-03-17T17:35:16.136Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-25T11:12:53.066Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Finder Bookings", "vendor": "aonetheme", "versions": [{"lessThanOrEqual": "5.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability."}, {"lang": "es", "value": "El complemento Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, es vulnerable a la escalada de privilegios en todas las versiones hasta la 5.1 incluida. Esto se debe a la falta de restricci\u00f3n del rol de usuario en la funci\u00f3n 'nsl_registration_store_extra_input'. Esto permite que atacantes no autenticados registren una cuenta en el sitio con un rol arbitrario, incluido el de Administrador, al registrarse mediante inicio de sesi\u00f3n con redes sociales. El complemento Nextend Social Login debe estar instalado y configurado para explotar esta vulnerabilidad."}], "id": "CVE-2025-2470", "lastModified": "2026-06-17T09:07:00.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2470", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-25T11:57:33.774415Z", "version": "2.0.3"}}]}, "published": "2025-04-25T12:15:16.903", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1f62cda-262b-46d9-a839-0a573813cfa1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:06:58.098483+00:00", "value": {"mitigation_remediation": ["Update the Service Finder Bookings plugin to a version newer than 5.1 that contains the fix.", "Disable or remove the Nextend Social Login plugin until the Service Finder Bookings plugin is updated.", "Audit existing user accounts for unauthorized Administrator roles and revoke any that were created via social login."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected software is the Service Finder Bookings plugin distributed by aonetheme, used by the Service Finder - Directory and Job Board WordPress Theme. All releases up to and including version\u202f5.1 are vulnerable. The issue only manifests when the plugin is used together with the Nextend Social Login plugin, which must be installed and properly configured on the WordPress site.\"", "description_and_impact": "The vulnerability arises from an unrestricted role assignment in the 'nsl_registration_store_extra_input' function of the Service Finder Bookings plugin. Because the function does not verify the user role before creating the account, an attacker can register via the Nextend Social Login integration and choose any role, including Administrator. This results in unauthenticated privilege escalation, allowing the attacker to gain full control over the WordPress site, a flaw consistent with CWE\u2011266.\"", "risk_and_exploitability": "The CVSS score of\u202f9.8 indicates a critical severity, while the EPSS score of less than\u202f1\u202f% signals a low probability of exploitation at any given time. The vulnerability is not listed in CISA\u2019s KEV catalog. An attacker can exploit it by registering a new user account through the social login flow and specifying an Administrator role, thereby bypassing authentication and gaining full administrative privileges on the site. Because no authentication is required and only the presence of the Nextend Social Login plugin is needed, the risk is high in environments that use this plugin."}}}}, "created": "2026-04-20T23:15:06.303929+00:00", "updated": "2026-04-20T23:15:06.303950+00:00", "vendors": []}