Hackers Actively Exploiting WordPress Plugin Vulnerability to Gain Admin Access

Over the past two months, a critical authentication bypass vulnerability in the Service Finder Bookings WordPress plugin has been actively exploited by threat actors, allowing them to take control of accounts on compromised websites.

The vulnerability, initially disclosed on Tue, Jul 31, 2025, was identified through a bug bounty submission. It stems from the servicefinderswitchback function's failure to validate a user-switch cookie prior to privilege escalation.

Following the disclosure, attackers reverse-engineered the flaw, leading to widespread exploitation campaigns starting Wed, Aug 1, and escalating throughout September.

During this period, the Wordfence Firewall blocked over 13,800 exploit attempts on thousands of sites running vulnerable versions of the plugin.

In the initial phase, attackers utilized specially crafted HTTP requests containing a malicious originaluserid cookie to completely bypass authentication.

Wordfence analysts observed a rapid increase in abnormal switchback requests soon after the vulnerability was disclosed, prompting the immediate implementation of a firewall rule for all Wordfence Premium, Care, and Response customers.

CVE ID Affected Plugin Versions Affected Patched Version CVSS 3.1 Score Attack Vector

CVE-2025-5947 Service Finder Bookings ≤ 6.0 6.1 9.8 Authentication Bypass

Sites using the free version of the firewall received protection after a 30-day delay, which left many installations vulnerable until mid-July.

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain full administrator privileges, enabling activities such as installing backdoors, data exfiltration, or site defacement.

With over 6,000 active installations of the vulnerable plugin, the threat landscape expanded as scanning bots and scripted exploit kits targeted Service Finder Bookings endpoints .

Attackers exploit the servicefinderswitchback endpoint by issuing a GET request to ?switchback=1 with the Cookie: originaluserid=<target_id> .

if ( isset( $_COOKIE['originaluserid'] ) ) { $originaluserid = intval( $_COOKIE['originaluserid'] ); wp_set_current_user( $originaluserid ); wp_set_auth_cookie( $originaluserid, true ); }

Due to the absence of authentication or nonce checks, the attacker’s user ID is accepted, logging them in as that user, often the site administrator. This bypass highlights the necessity for stringent input validation in session-handling routines.

Based on reporting by Cyber Security News.