Loading story…
A critical authentication bypass vulnerability, tracked as CVE-2025-5947, has been discovered and actively exploited in the Service Finder WordPress theme. This flaw allows unauthenticated attackers to gain access to any account on affected WordPress sites, including those with administrator privileges. The vulnerability stems from improper validation of the original_user_id cookie in the service_finder_switch_back() function, enabling privilege escalation and unauthorized account access. The Service Finder theme, which is widely used for service directory and job board websites, has been sold to over 6,000 customers via Envato Market, making the impact of this vulnerability significant. Security researcher 'Foxyyy' identified the issue and reported it through Wordfence’s bug bounty program on June 8, 2025. The vendor, Aonetheme, released a patch in version 6.1 on July 17, 2025, addressing the vulnerability for all versions prior to and including 6.0. Despite the patch, exploitation attempts began in earnest after public disclosure at the end of July, with Wordfence recording over 13,800 attack attempts since August 1, 2025. Attackers have been observed using specific IP addresses to target the vulnerable account switching function, and a surge of more than 1,500 daily attack attempts was noted for about a week starting September 23. The typical attack involves an HTTP GET request with a switch_back=1 query parameter, allowing the attacker to impersonate any user. Successful exploitation could allow attackers to hijack sites, insert malicious code, redirect users to phishing sites, or use compromised sites to host malware. The full extent of successful compromises remains unclear, but the scale of attempted exploitation highlights the urgency for administrators to update their themes. Administrators are strongly advised to audit their sites for suspicious activity, apply the latest patch, and monitor for unauthorized access. The vulnerability’s critical CVSS score of 9.8 underscores the risk to affected sites. The Service Finder theme’s popularity among active business sites increases the potential for widespread impact. Wordfence continues to monitor exploitation activity and has provided indicators of compromise, including a list of attacking IP addresses. The incident demonstrates the importance of timely patching and vigilant monitoring for WordPress site operators using third-party themes and plugins. Security firms recommend immediate action to mitigate the risk of site takeover and data compromise. The rapid exploitation following public disclosure illustrates the speed at which threat actors can weaponize newly revealed vulnerabilities in popular web platforms.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
By early October 2025, Wordfence said it had blocked more than 13,800 exploitation attempts targeting CVE-2025-5947. The company also published technical details and indicators, including the attack method and a set of source IP addresses tied to the activity.
Starting September 23, 2025, daily intrusion attempts against vulnerable Service Finder sites surpassed 1,500, indicating a notable escalation in exploitation activity. Reports said many attacks originated from five IP addresses and used HTTP GET requests for user impersonation attempts.
Wordfence observed active exploitation of the Service Finder authentication bypass starting on August 1, 2025. Attackers used forged original_user_id cookies and switch_back requests to attempt account takeover on vulnerable WordPress sites.
Wordfence publicly disclosed CVE-2025-5947 on July 31, 2025, describing a critical cookie-validation flaw in the service_finder_switch_back() function that could let unauthenticated attackers log in as any user, including administrators.
The vendor released Service Finder theme version 6.1 on July 17, 2025, fixing a critical authentication bypass flaw in the bundled Bookings plugin that affected versions 6.0 and earlier.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting critical vulnerabilities in popular WordPress plugins and themes, enabling the hijacking of administrator accounts and full site compromise. The Post SMTP plugin, installed on over 400,000 WordPress sites, is affected by CVE-2025-11833, a flaw that allows unauthenticated attackers to read arbitrary logged emails, including password reset messages, due to missing authorization checks. This exposure enables attackers to reset admin passwords and take over sites. Wordfence has observed over 4,500 exploit attempts since November 1, and a patch was released in version 3.6.1, but a significant number of sites remain unpatched and vulnerable. Similarly, the JobMonster WordPress theme is being targeted via CVE-2025-5397, an authentication bypass vulnerability that allows attackers to hijack admin accounts when social login is enabled. The flaw arises from improper verification in the `check_login()` function, letting attackers fake admin access if they know the username or email. The issue is fixed in version 4.8.2, and users are urged to update, disable social login, and enable two-factor authentication. These incidents highlight the ongoing risk posed by unpatched WordPress components and the need for immediate mitigation to prevent site compromise.
Jun 29, 2026
A critical security vulnerability, tracked as CVE-2025-6388, has been identified in the Spirit Framework plugin for WordPress, affecting all versions up to and including 1.2.14. The flaw is rooted in the custom_actions() function, which fails to properly validate user identities before authenticating them to the site. This oversight allows unauthenticated attackers to log in as any user, including administrators, provided they know the target username. The vulnerability has been assigned a CVSS score of 9.8, indicating its severe risk level. Security provider Wordfence has confirmed that this vulnerability is being actively exploited in the wild, having blocked 20 attack attempts within a 24-hour period. Attackers leveraging this flaw can bypass standard authentication mechanisms, seize control of user accounts, escalate privileges to administrator, and potentially install backdoors or inject malicious content. The widespread use of WordPress for enterprise, e-commerce, and personal websites amplifies the potential impact of this vulnerability. The Spirit Framework plugin is popular among WordPress site administrators, increasing the number of potentially affected sites. The developers have responded by releasing version 1.2.15 of the plugin, which patches the authentication bypass by ensuring proper identity validation. Website administrators are strongly urged to update to the latest version immediately to mitigate the risk of account takeover and privilege escalation. Failure to apply the patch leaves sites exposed to full compromise, including the risk of data theft, defacement, or further malware deployment. The vulnerability does not require knowledge of a password, only the username of a valid account, making exploitation relatively straightforward for attackers. The incident underscores the importance of prompt patch management and the risks associated with third-party plugins in widely used content management systems. Security advisories have been issued to alert the community, and monitoring for signs of compromise is recommended for sites running affected versions. The rapid exploitation observed highlights the need for continuous vigilance and timely response to critical vulnerabilities in the WordPress ecosystem. Organizations should review their plugin inventories and ensure all components are up to date to prevent similar incidents. The disclosure and patch release demonstrate effective collaboration between security researchers, vendors, and the broader WordPress community in addressing high-impact threats.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as **`CVE-2026-15826`**, affects the WordPress plugin **User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor** in versions up to and including **`3.16.4`**. The flaw carries a **CVSS 9.8** rating and stems from a type confusion bug in the plugin’s autologin flow: a `WP_Error` returned by `wp_insert_user()` can be passed through `absint()` before error handling, coercing the value to integer `1`. An unauthenticated attacker can exploit this by registering with a username between **61 and 70 characters**, causing the plugin to generate an autologin nonce for **user ID 1**, which is commonly the site administrator. Successful exploitation can result in full administrative takeover of affected WordPress sites, particularly where **user ID 1** still belongs to an administrator account. Reports said roughly **40,000 sites** were exposed. The issue was patched in **`3.16.5`**, and defenders were urged to update immediately, review administrator accounts for unauthorized access, and verify whether the default administrator mapping to user ID 1 remains in place. Wordfence said firewall protections were released first to paid customers and later to free users.
Aug 17, 2026