This vulnerability in the Service Finder Booking plugin by aonetheme involves incorrect privilege assignment, which can be exploited to escalate privileges. It affects versions up to and including 6.1. The CVSS 3.1 base score of 9.8 reflects that the vulnerability is remotely exploitable without authentication or user interaction and results in complete compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation guidance is currently provided in the available data.

Successful exploitation of this vulnerability allows an attacker to escalate privileges on the affected system, potentially gaining full control. This can lead to unauthorized access, data compromise, and disruption of service. Given the critical CVSS score and the nature of the flaw, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to privilege escalation attempts. Avoid deploying the affected versions in sensitive environments if possible.