WordPress Service Finder SMS System Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Service Finder SMS System plugin for WordPress, affecting all versions through 2.0.0. The issue arises because the plugin does not limit user role selection during registration, allowing unauthenticated attackers to create accounts as administrators. This vulnerability is linked to the aonesms_fn_savedata_after_signup() function.

Impact

Exploitation of this vulnerability allows for unauthorized account creation with administrative privileges, potentially leading to further malicious actions within the WordPress site.

Remediation

Users are advised to update the Service Finder SMS System plugin to version 3.0.0 or later, where this vulnerability has been patched.