CVE-2025-5948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5948", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T18:21:57.104Z", "datePublished": "2025-09-19T05:28:51.272Z", "dateUpdated": "2026-04-08T17:03:12.764Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:12.764Z"}, "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs."}], "title": "Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-09-18T16:31:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-19T11:53:39.159716Z", "id": "CVE-2025-5948", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T11:54:56.861Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5948", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-19T11:53:39.159716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T11:54:51.637Z"}}], "cna": {"title": "Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-18T16:31:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:12.764Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5948", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:12.764Z", "dateReserved": "2025-06-09T18:21:57.104Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-19T05:28:51.272Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Finder Bookings", "vendor": "aonetheme", "versions": [{"lessThanOrEqual": "6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs."}], "id": "CVE-2025-5948", "lastModified": "2026-06-17T09:49:05.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5948", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-19T11:53:39.159716Z", "version": "2.0.3"}}]}, "published": "2025-09-19T06:15:35.380", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:03:04.986456+00:00", "value": {"mitigation_remediation": ["Upgrade Service Finder Bookings to the latest version (6.1 or newer) which removes the unauthenticated claim_business vulnerability.", "If an upgrade is not immediately possible, disable the claim_business AJAX action by adding a rule in the .htaccess or server configuration to block access to /wp-admin/admin-ajax.php for that specific action id, or modify the plugin\u2019s functions to reject unauthenticated requests.", "Review user account privileges and consider removing or restricting the claim features entirely on production sites, and monitor for any unauthorized claim requests in the site\u2019s logs."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Unauthenticated Account Takeover"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Service Finder Bookings plugin from aonetheme with versions up to and including 6.0 are impacted. All installations of the plugin regardless of additional security plugins or custom modifications remain vulnerable unless the plugin is upgraded beyond version 6.0.", "description_and_impact": "The Service Finder Bookings WordPress plugin allows unauthenticated users to claim any business through the claim_business AJAX action without proper identity validation. This flaw enables an attacker to assume the identity of any user, including administrators, effectively performing an account takeover. The vulnerability is a classic case of privilege escalation as defined by CWE-639, where privileged operations are performed without proper authorization checks.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.8, indicating critical severity, but the EPSS score is less than 1%, suggesting exploit attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated attacker sending the claim_business action to the plugin's AJAX endpoint, which then accepts the supplied claim_id. Successful exploitation requires an attacker to acquire a valid claim ID\u2014either by brute\u2011forcing or by leveraging a subscriber\u2011level account\u2014making the attack more complex than a simple direct login. Once a valid claim ID is obtained, the attacker can log in as the target user, including admin accounts."}}}}, "created": "2025-09-22T10:00:15.555156+00:00", "updated": "2026-04-21T19:15:26.027277+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}