The Service Finder Bookings plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) due to improper validation of user identity in the claim_business AJAX action. This allows unauthenticated attackers to escalate privileges by taking over accounts, including admin accounts, by supplying a valid claim_id. While subscriber privileges or brute-forcing are necessary to complete the takeover, the vulnerability enables attackers to bypass normal authentication controls. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild or an available patch at this time.

Successful exploitation allows unauthenticated attackers to fully compromise user accounts, including administrative accounts, leading to complete loss of confidentiality, integrity, and availability of the affected WordPress site. This can result in unauthorized access, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting access to the claim_business AJAX action if possible, and monitor for suspicious activity related to business claiming functionality. Avoid exposing the plugin on publicly accessible sites without additional protective controls.