CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts

According to Wordfence, CVE-2025-5947 is a critical vulnerability in the Service Finder WordPress theme’s Bookings plugin, with versions up to and including 6.0 suffering an authentication bypass that lets attackers log in as any user, including admins, due to improper cookie validation. The advisory notes that the flaw enables privilege escalation via the service_finder_switch_back() function, which uses the original_user_id cookie without proper authentication checks.

A researcher using the moniker Foxyyy reported the vulnerability, and Wordfence observed that exploitation began the day after the patch was released, on 1 August 2025, with the firewall subsequently blocking over 13,800 exploit attempts. The patched version was released on 17 July 2025 and the vulnerability was publicly disclosed on 31 July 2025.

Wordfence also identified five IP addresses targeting the plugin’s account-switching function: 5.189.221[.]98, 185.109.21[.]157, 192.121.16[.]196, 194.68.32[.]71, and 178.125.204[.]198, though it notes that indicators of compromise are not always obvious beyond requests containing the switch_back parameter.