Zero-Click WordPress Mass Hack your Site is Already Pwned

A critical authentication bypass vulnerability (CVE-2025-5947) has been identified in the Service Finder Bookings WordPress plugin, rated with a CVSS score of 9.8. Active exploitation campaigns have been observed since August 2025, enabling unauthenticated attackers to compromise any user account, including administrative privileges, leading to complete site takeover.

Key Risk Indicators

Threat Level: CRITICAL
Exploitation Status: ACTIVE IN WILD
Patch Availability: YES (Version 6.1+)
Response Urgency: IMMEDIATE ACTION REQUIRED

VULNERABILITY TECHNICAL SPECIFICATION

Core Vulnerability Metrics

Parameter	Details
CVE Identifier	CVE-2025-5947 (Primary), CVE-2025-5948 (Secondary)
CVSS Score	9.8 (Critical)
Vulnerability Type	Authentication Bypass
Attack Vector	Network (Unauthenticated)
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Changed
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High

Root Cause Analysis

Primary Attack Vector (CVE-2025-5947)

Vulnerable Function: `service_finder_switch_back()` Root Cause: Improper validation of user-supplied cookie parameters Technical Mechanism: ```php // Vulnerable code pattern (simplified) function service_finder_switch_back() { $user_id = $_COOKIE['switch_user_id']; // No proper validation wp_set_current_user($user_id); // Direct privilege assignment } ``` Impact: Allows unauthenticated attackers to specify any user ID and assume that identity.

Secondary Attack Vector (CVE-2025-5948)

Vulnerable Endpoint: `claim_business` AJAX action Root Cause: Missing authorization checks Impact: Enables account takeover through business claim functionality.

IMPACT ASSESSMENT

Immediate Risk Profile

Impact Area	Severity	Description
Privilege Escalation	Critical	Unauthenticated attackers can become any user
Administrative Compromise	Critical	Full WordPress admin access achievable
Data Confidentiality	High	Access to all user data, including potential PII
Data Integrity	Critical	Modify/delete any content or user data

Attack Chain Analysis

REMEDIATION PROTOCOL

Immediate Response Timeline

CRITICAL ACTIONS (0-24 HOURS)

IMMEDIATE CONTAINMENT

Update Service Finder Bookings to version 6.1+
Alternative: Disable plugin if update not possible
Force logout all users (invalidate sessions)

COMPROMISE ASSESSMENT

Review user accounts for unauthorized administrators
Check for suspicious plugins/themes
Scan for web shells and backdoors

PRIORITY ACTIONS (24-72 HOURS)

FORTIFICATION

Implement WAF rules blocking exploitation attempts
Change all administrative passwords
Enable enhanced logging

Step-by-Step Remediation Guide

Phase 1: Emergency Patching

# WordPress CLI command to update plugin
wp plugin update service-finder-bookings

# Alternative: Disable plugin
wp plugin deactivate service-finder-bookings

Phase 2: Compromise Assessment

User Account Audit

Review WordPress users table for new admin accounts
Check user registration dates and last login times
Verify administrator email addresses

File System Analysis

Compare core files with fresh WordPress installation
Scan uploads directory for suspicious PHP files
Check .htaccess for malicious redirects

Database Integrity Check

Review wp_options for malicious code injections
Check for unauthorized plugin installations
Verify post/content modifications

Phase 3: Security Hardening

Access Control Reinforcement

Implement two-factor authentication
Limit login attempts
Restrict admin access by IP

Monitoring Enhancement

Enable real-time security alerts
Monitor for authentication anomalies
Implement file integrity monitoring

THREAT INTELLIGENCE INDICATORS

4.1 Known Attack Infrastructure

IP Address	First Seen	ASN	Country	Threat Score
5.189.221.98	August 2025	51167	Romania	High
185.109.21.157	August 2025	210644	Russia	High
192.121.16.196	September 2025	51167	Romania	High
194.68.32.71	September 2025	197351

Compromise Detection Signatures

HTTP Request Patterns

# Suspicious request patterns to monitor
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" security

# Detection rules for exploitation attempts
RewriteCond %{QUERY_STRING} "action=service_finder_switch_back" [NC]
RewriteCond %{QUERY_STRING} "user_id=[0-9]+" [NC]
RewriteRule .* - [F,L]

WordPress Log Analysis Queries

-- Check for suspicious user privilege changes
SELECT * FROM wp_users 
WHERE user_registered > '2025-08-01' 
AND user_level = 10;

-- Review user meta for role changes
SELECT * FROM wp_usermeta 
WHERE meta_key = 'wp_capabilities' 
AND meta_value LIKE '%administrator%';