CVE-2025-5947 is a critical authorization bypass vulnerability in the Service Finder Bookings WordPress plugin by aonetheme. The flaw exists in all versions up to and including 6.0, where the plugin fails to properly validate a user's cookie before logging them in through the service_finder_switch_back() function. This improper validation enables unauthenticated attackers to impersonate any user, including administrators, effectively escalating privileges without authentication. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation allows unauthenticated attackers to log in as any user, including administrators, on WordPress sites using the vulnerable plugin. This leads to complete compromise of the affected site, including potential data theft, site defacement, and further malicious activity. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — no official fix or patch links have been provided by the vendor. Users should monitor the vendor's advisory for updates and apply any official patches once available. Until then, consider disabling the plugin or restricting access to the affected functionality as a temporary mitigation.