CVE-2025-6574

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6574", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-24T14:07:03.697Z", "datePublished": "2025-11-01T06:40:36.491Z", "dateUpdated": "2026-04-08T16:42:42.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:42.084Z"}, "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"version": "0", "status": "affected", "lessThan": "6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account."}], "title": "Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "timeline": [{"time": "2025-10-31T18:15:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T13:22:12.474119Z", "id": "CVE-2025-6574", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:30:52.307Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6574", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-03T13:22:12.474119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T13:22:13.222Z"}}], "cna": {"title": "Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "aonetheme", "product": "Service Finder Bookings", "versions": [{"status": "affected", "version": "*", "lessThan": "6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T18:15:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=cve"}, {"url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-01T06:40:36.491Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6574", "state": "PUBLISHED", "dateUpdated": "2025-11-03T13:30:52.307Z", "dateReserved": "2025-06-24T14:07:03.697Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T06:40:36.491Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Finder Bookings", "vendor": "aonetheme", "versions": [{"lessThan": "6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account."}, {"lang": "es", "value": "El plugin Service Finder Bookings para WordPress es vulnerable a escalada de privilegios a trav\u00e9s de la toma de control de cuentas en todas las versiones anteriores a la 6.1. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar sus detalles como el correo electr\u00f3nico. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, cambien las direcciones de correo electr\u00f3nico de usuarios arbitrarios, incluyendo las de los administradores, y aprovechen eso para restablecer la contrase\u00f1a del usuario y obtener acceso a su cuenta."}], "id": "CVE-2025-6574", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6574", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T13:22:12.474119Z", "version": "2.0.3"}}]}, "published": "2025-11-01T07:15:35.727", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/264cb002-bf40-4cc2-9c21-cda9bb24f494?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:45:06.755422+00:00", "value": {"mitigation_remediation": ["Upgrade Service Finder Bookings to version 6.1 or later to apply the vendor\u2019s fix for identity validation", "If an upgrade is delayed, restrict the permissions of subscriber roles so that they cannot edit user profiles or email addresses", "Immediately reset strong passwords for all administrator accounts and review recovery options to prevent unauthorized resets", "Monitor the site\u2019s user\u2011management logs for anomalous email changes or reset requests"], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Account Takeover"}, "threat_synthesis": {"affected_systems": "This issue affects the Service Finder Bookings WordPress plugin from aonetheme for all released versions prior to 6.1. Any WordPress installation using these older plugin versions is susceptible.", "description_and_impact": "The Service Finder Bookings plugin for WordPress allows an authenticated user with subscriber level access or higher to modify any user\u2019s email address. Because the plugin does not verify the identity of the user making the change, a malicious account can change the email of an administrator or other privileged user, trigger a password reset, and take control of that account. This flaw allows an attacker to update any user\u2019s email address and potentially take over their account via password reset. The weakness is an identity validation failure, classified as CWE\u2011639.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating high potential impact. However, the EPSS score is below 1%, suggesting that exploitation is currently uncommon. The flaw is not listed in the CISA KEV catalog. An attacker must already be authenticated with a subscriber or higher role, then use the plugin\u2019s user\u2011management interface to modify another user\u2019s email. Once the email is changed, the attacker can initiate a password reset and gain administrative access."}}}}, "created": "2025-11-03T10:43:36.080632+00:00", "updated": "2026-04-22T16:45:21.467394+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}