What is the CVSS score of CVE-2026-28161?

CVE-2026-28161 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Service Finder Booking are affected by CVE-2026-28161?

Service Finder Booking WordPress plugin versions 6.2 and below contain a privilege escalation vulnerability (CVSS 8.8) allowing authenticated subscriber-level users to gain administrative control,…

How to fix or mitigate CVE-2026-28161?

Within 24 hours: Audit all WordPress deployments to identify instances running Service Finder Booking plugin version 6.2 or below; immediately disable the plugin or restrict new subscriber account registration as an interim control. Within 7 days: Deploy Web Application Firewall rules targeting privilege escalation attempts; audit existing subscriber accounts for unauthorized administrative role assignments; implement enhanced logging and alerting for WordPress administrative actions. Within 30 days: Coordinate with the plugin vendor regarding patch timeline; no vendor-released patch identified at time of analysis, so evaluate alternative booking plugins meeting organizational security requirements and plan migration if a patch is not released within this window.

Service Finder Booking CVE-2026-28161

EUVD-2026-57953 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-13 Patchstack

GHSA-x3q9-w99r-j42c

WordPress Privilege Escalation Wordpress Plugin Service Finder Booking

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-exploitable with low complexity; PR:L confirmed as subscriber account required; full C/I/A impact upon successful privilege escalation; scope unchanged within WordPress installation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:55 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.8

DescriptionCVE.org

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

AnalysisAI

Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.

Technical ContextAI

The affected component is the 'Service Finder Booking' plugin by aonetheme (CPE: cpe:2.3:a:aonetheme:service_finder_booking:*:*:*:*:*:*:*:*) - a WordPress booking and service marketplace plugin. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to enforce proper server-side authorization checks before granting elevated capabilities to subscriber-role users. In WordPress, subscribers are the lowest default role; they can read content but hold no administrative capabilities. A CWE-266 flaw in this context typically manifests as missing or bypassed capability checks in plugin AJAX handlers, REST API endpoints, or form-processing logic that allow subscribers to invoke privileged functions - such as modifying bookings, accessing other users' data, or escalating to administrator-level roles.

RemediationAI

Upstream fix availability and an exact patched version have not been independently confirmed from the data available at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sf-booking/vulnerability/wordpress-service-finder-booking-plugin-6-2-privilege-escalation-vulnerability) should be checked for the current patched release. Site administrators should update the Service Finder Booking plugin to any version confirmed by Patchstack or the plugin vendor as patched beyond 6.2. If an update is not immediately available, the most effective compensating control is to disable open user registration (WordPress Settings > General > uncheck 'Anyone can register') to prevent untrusted parties from obtaining subscriber accounts. Additionally, review existing subscriber accounts for signs of unauthorized privilege changes. Consider placing the WordPress admin area behind IP allowlisting or additional authentication as a defense-in-depth measure. Disabling the plugin entirely until a patch is confirmed is the safest option for high-sensitivity deployments.