CVE-2025-5949

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5949", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-09T18:27:58.059Z", "datePublished": "2025-11-01T04:27:42.063Z", "dateUpdated": "2026-04-08T17:12:41.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:41.115Z"}, "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins."}], "title": "Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "timeline": [{"time": "2025-10-31T16:21:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T20:48:33.168839Z", "id": "CVE-2025-5949", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:48:46.815Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5949", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T20:48:33.168839Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:48:43.327Z"}}], "cna": {"title": "Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password", "credits": [{"lang": "en", "type": "finder", "value": "Friderika Baranyai"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T16:21:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:41.115Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5949", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:41.115Z", "dateReserved": "2025-06-09T18:27:58.059Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T04:27:42.063Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Finder Bookings", "vendor": "aonetheme", "versions": [{"lessThanOrEqual": "6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins."}, {"lang": "es", "value": "El plugin Service Finder Bookings para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 6.0, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de procesar una solicitud de cambio de contrase\u00f1a. Esto hace posible que atacantes autenticados con acceso de suscriptor o superior restablezcan las contrase\u00f1as de otros usuarios, incluidas las de los administradores."}], "id": "CVE-2025-5949", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5949", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T20:48:33.168839Z", "version": "2.0.3"}}]}, "published": "2025-11-01T05:16:02.763", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:38:30.817386+00:00", "value": {"mitigation_remediation": ["Upgrade the Service Finder Bookings plugin to a version later than\u202f6.0 that contains the fix for the password change validation issue.", "If an immediate upgrade is not possible, restrict the change_candidate_password functionality by removing the capability from all roles except administrators, or disable the endpoint entirely for a temporary patch.", "Audit all user accounts to ensure that only trusted users have subscriber or higher roles, and monitor account\u2011change events for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Service Finder Bookings plugin installed in any release up to and including version\u202f6.0 are affected. The vulnerability was discovered in the plugin hosted on ThemeForest and affects users who have deployed the plugin on their WordPress sites.", "description_and_impact": "The Service Finder Bookings plugin for WordPress allows a user who is authenticated with a subscriber role or higher to maliciously change the password of any other account, including administrators. The vulnerability exists because the plugin does not verify the requester's identity before processing a password change, a classic account takeover flaw (CWE\u2011639). An attacker who can log in can reset another user\u2019s password, thereby gaining that user\u2019s access and violating both confidentiality and integrity of the site.", "risk_and_exploitability": "The listing has a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1\u202f%, suggesting that the probability of exploitation in the wild is currently low. The vulnerability is not yet reported in the CISA KEV catalog. Because the flaw requires only that the attacker be an authenticated user with subscriber privileges, the attack vector is likely an authenticated user interface or API call to change_candidate_password. Exploitation would involve the attacker submitting a request to reset a target account\u2019s password, which the plugin will accept without further validation, effectively allowing the attacker to take full control of the target account."}}}}, "created": "2025-11-03T10:43:42.513014+00:00", "updated": "2026-04-20T21:45:18.967014+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}