Service Finder Bookings - Authentication Bypass Detection

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. !/usr/bin/env python3 -- coding: utf-8 -- """Service Finder Bookin...

WordPress Service Finder Bookings Plugin Unauthorized Access

The vulnerability of the servicefinderswitchback function in the Service Finder Bookings plugin of the WordPress content management system involves bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

CVE-2025-5947: Authorization Bypass Through User-Controlled Key

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the servicefinderswitchback function...