CVE-2026-28161 HIGH

CVE-2026-28161: WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

Vendor Aonetheme
Product Service Finder Booking
Weakness CWE-266
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Service Finder Booking versions up to 6.2 contain a privilege assignment flaw that allows authenticated users with low-level access to gain high-level permissions. An attacker can read sensitive data, modify site content, or disrupt service availability. The vulnerability requires a valid user account but no additional user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt site availability with escalated privileges.

Potential impact on your site

04Site Impact

Any registered user can escalate their permissions to perform admin-level actions without authorization.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-27541 WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability CVE-2026-39470 WordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerability CVE-2026-49780 WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability CVE-2025-15656 WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability CVE-2026-24963 WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability