Service Finder Bookings - Authentication Bypass

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. id: CVE-2025-5947 info: name: Service Finder Bookings -...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73392

The WordPress Super Store Finder plugin (versions ≤7.8) has an unauthenticated SQL injection flaw, allowing remote attackers to execute arbitrary SQL queries without credentials. Patchstack rates it CRITICAL (CVSS 9.3). No patch or exploit details are provided in the documents.

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

EUVD-2026-60799

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-28161

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28161

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28161 WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

EUVD-2026-57953

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

CVE-2026-28161

CVE-2026-28161 affects the WordPress Service Finder Booking plugin

CVE-2026-28159

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

EUVD-2026-57952

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28159

CVE-2026-28159 affects the WordPress plugin “Service Finder Booking” up to version 6.2. The vulnerability is described as Broken Access Control, with CVSS3.1 base metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (medium). Impact: Unauthorized access could affect availability of the service or booking...

PT-2026-71519

Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-12965

The CVE-2026-12965 entry concerns the WordPress plugin Super Store Finder (versions up to 7.8). It describes an issue where a parameter from an unauthenticated AJAX action is not sanitized before being used in a SQL query, enabling SQL injection and data extraction from the database. This is the ...