Service Finder Bookings WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Service Finder Bookings plugin for WordPress, affecting all versions through 6.0. The issue arises from the plugin's failure to properly validate user cookie values before logging users in via the 'service_finder_switch_back()' function. This flaw allows unauthenticated attackers to log in as any user, including administrators.

Impact

Exploitation of this vulnerability allows for unauthorized login as any user, potentially including administrative accounts.

Remediation

Users are advised to update the Service Finder Bookings plugin to version 6.1 or a newer patched version.