CVE-2025-5954 is a critical vulnerability in the Service Finder SMS System plugin for WordPress, affecting all versions up to and including 2.0.0. The flaw arises from improper privilege management (CWE-269) where the plugin fails to restrict user role assignment during registration, specifically in the aonesms_fn_savedata_after_signup() function. This allows unauthenticated attackers to create accounts with administrator privileges, effectively enabling privilege escalation and full control over the affected WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical nature and ease of exploitation without authentication or user interaction.

Successful exploitation allows unauthenticated attackers to register as administrator users, granting full control over the WordPress site running the vulnerable plugin. This compromises confidentiality, integrity, and availability of the site and its data. There are no known exploits in the wild at the time of publication, but the vulnerability's critical severity and ease of exploitation pose a significant risk.

No official patch or fix has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable or uninstall the Service Finder SMS System plugin if possible, or restrict access to the registration functionality to trusted users only. Monitor vendor channels for updates and apply official patches promptly once released.