Critical Exploit Lets Hackers Bypass Authentication in WordPress Service Finder Theme

A critical vulnerability in the WordPress Service Finder theme’s plugin, Service Finder Bookings, could allow an unauthenticated attacker to gain access to any account, including administrators, by bypassing authentication. Tracked as CVE-2025-5947 with a CVSS of 9.8, the flaw arises from the plugin not adequately validating a user’s cookie value before logging them in via the account-switching function service_finder_switch_back().

According to Wordfence, this effectively enables privilege escalation and site takeover, with exploitation observed since 1 August 2025 and over 13,800 attempts to date, though the success rate is not yet clear. The issue affects all versions of the theme prior to and including 6.0, and was addressed by the plugin maintainers on 17 July 2025 with the release of version 6.1; Envato Market data put the theme at more than 6,100 customers.

Administrators are advised to audit sites for suspicious activity and ensure all plugins and themes are up to date, while observed targeting IPs include 5.189.221[.]98, 185.109.21[.]157, 192.121.16[.]196, 194.68.32[.]71 and 178.125.204[.]198.