Actively Exploited: Critical Flaw CVE-2025-5947 (CVSS 9.8) Allows Unauthenticated Admin Takeover in WordPress Plugin

Actively exploited CVE-2025-5947, which carries a CVSS score of 9.8, allows an unauthenticated attacker to takeover administrator accounts in the Service Finder Bookings plugin, a component bundled with the Service Finder WordPress theme used by around 6,000 customers worldwide. According to Wordfence, the authentication bypass arises from an insecure account-switching feature implemented by the service_finder_switch_back() function, which does not perform authentication or authorization checks.

The flaw can be triggered by sending a simple HTTP request to a vulnerable site using a crafted cookie, with an example being GET /?switch_back=1 and Cookie: original_user_id=1, effectively logging in as the WordPress administrator without credentials. Wordfence notes that the vulnerability was patched on 17 July 2025 and publicly disclosed on 31 July 2025, but exploitation began the next day, 1 August 2025, with the firewall blocking more than 13,800 exploit attempts.

Exploitation campaigns persisted through September, primarily from a small cluster of aggressive IPs, though there are few obvious indicators of compromise beyond requests containing the switch_back parameter.