Hackers Targeting WordPress Plugin Vulnerability to Seize Admin Access

Hackers are exploiting a critical authentication bypass in the Service Finder Bookings plugin, which is bundled with the Service Finder theme, enabling unauthenticated attackers to assume administrator privileges on thousands of WordPress sites.

Exploitation began within 24 hours of public disclosure, and over 13,800 exploit attempts have been blocked by the Wordfence Firewall to date, with data showing clusters of mass scanning from IPs such as 5.189.221[.]98 (2,700 blocked requests) and 185.109.21[.]157 (2,600 blocked requests) between 22 and 29 September.

On 8 June 2025, a submission to the Wordfence Bug Bounty Program revealed an Authentication Bypass vulnerability in Service Finder Bookings, and approximately 6,000 sites purchased the theme, creating a sizeable attack surface; the flaw resides in the plugin’s service_finder_switch_back() function, which uses a cookie value without authentication checks.

The vendor patched the issue in version 6.1 on 17 July 2025, and Wordfence publicly disclosed the vulnerability on 31 July 2025; CVSS is rated 9.8 for CVE-2025-5947, and between 1 August and 29 September, over 13,800 malicious requests were blocked, with further protection available to premium users. According to Wordfence, administrators should update to version 6.1 immediately, review logs for switch_back activity, and deploy patched or custom WAF rules to mitigate ongoing risk.