Service Finder Booking
Monthly
Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.
Privilege escalation in the Service Finder Booking WordPress plugin (versions 6.2 and below) allows any authenticated subscriber-level user to elevate their privileges within the application, resulting in full confidentiality, integrity, and availability impact. The flaw is network-exploitable with low complexity and requires only a valid subscriber account, making it accessible to any registered user on affected sites. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 score reflects the high-impact potential once a low-privileged account is obtained.
Broken access control in the Service Finder Booking WordPress plugin (versions up to and including 6.2) allows authenticated subscribers to trigger high-availability-impact actions they should not be authorized to perform. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify that the requesting user has sufficient privileges before executing sensitive operations. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make it straightforward to trigger once a subscriber account is obtained.