Service Finder Booking CVE-2026-28161

Exploitation requires the attacker to hold a valid WordPress subscriber-level account on the target site, as confirmed by the CVSS vector PR:L (low privileges). This means the target site must either permit open user registration, or the attacker must have acquired subscriber credentials through another means. No special plugin configuration or non-default feature flag appears required beyond the plugin being installed and active on a WordPress site running version 6.2 or below. What limits exploitation: sites with disabled user registration significantly raise the bar, as the attacker must obtain credentials through phishing, credential stuffing, or purchasing access. No additional special configuration, specific platform, or prior administrator interaction is required once a subscriber account is held.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity, network-exploitable flaw requiring only a low-privileged account and no user interaction. Real-world risk is contingent on whether the target WordPress site allows open user registration or if subscriber credentials can be obtained through other means (e.g., purchased access, leaked credentials, or weak account policies). No EPSS data was provided, and the absence of a KEV listing and public POC at time of analysis moderates immediate mass-exploitation risk. However, privilege escalation flaws in WordPress plugins are a highly sought class and are often weaponized quickly after disclosure. The low attack complexity and full C/I/A impact make this a genuine priority for sites running the plugin with open registration, even in the absence of confirmed active exploitation.

An attacker registers a free subscriber account on a WordPress site running Service Finder Booking 6.2, then sends a crafted HTTP request - likely to a plugin-registered AJAX handler or REST endpoint - that invokes a privileged function without proper capability checks. The missing or bypassed authorization allows the subscriber to perform administrative actions such as modifying other users' bookings, accessing sensitive booking data, or escalating their own WordPress role to administrator, resulting in full site compromise. No public POC has been identified at time of analysis.