What the vulnerability does
01Description
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Explanation of Vulnerability in Simple Terms
02Summary
Service Finder Bookings versions before 6.1 contain an authorization flaw that allows authenticated users with low privileges to read, modify, or delete sensitive data and disrupt service availability. The vulnerability requires a valid user account but no special interaction. All affected installations should update immediately to version 6.1 or later.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete sensitive data; disrupt service availability.
Potential impact on your site
04Site Impact
Unauthorized data access, modification, or deletion by any authenticated user; potential service downtime.
Conditions required to exploit
05Prerequisites
Valid user account with low privileges; network access to the application.
Key dates
06Disclosure timeline
November 1, 2025
CVE published
April 8, 2026
Record updated
