Service Finder Booking CVE-2026-28159

Exploitation requires a valid WordPress subscriber-level account on the target site, meaning either open user registration is enabled (the default for many service marketplace sites using this plugin) or the attacker has obtained any low-privilege credential. No further configuration beyond the plugin being installed and active is indicated. Exploitation is limited by the authentication requirement (PR:L) - unauthenticated visitors cannot exploit this flaw. Sites that have disabled public registration or restricted the subscriber role to trusted users face significantly reduced risk. The impact is limited to availability (C:N/I:N/A:H), so data exfiltration is not a concern from this vector alone.

The CVSS base score of 6.5 (Medium) is driven by network-accessible exploitation (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and high availability impact (A:H). The PR:L metric confirms exploitation requires an authenticated subscriber account - registration must be open or an attacker must obtain credentials. No EPSS data was provided in the intelligence feed; without it, exploitation probability cannot be quantified. No CISA KEV listing and no confirmed POC code means active exploitation is not established. The real-world risk is moderate: the availability-only impact (C:N/I:N) limits the worst-case outcome to service disruption rather than data breach, reducing urgency for most operators. However, for a live booking business, availability disruption directly impacts revenue. The low attack complexity means exploitation is trivial once subscriber access is obtained, warranting prompt patching on sites with open user registration.

An attacker registers a free subscriber account on the target WordPress site (or obtains credentials through credential stuffing). They then send a crafted network request to the vulnerable plugin endpoint - bypassing authorization checks - to trigger a high-impact availability action such as mass-canceling bookings or corrupting service listings. No public POC has been identified at time of analysis, but the low complexity means any authenticated subscriber can replicate the attack without specialized tooling.