The Service Finder SMS System plugin for WordPress contains an authentication bypass vulnerability (CWE-288) identified as CVE-2025-5955. This issue exists because the plugin fails to verify the user's phone number before authenticating, enabling unauthenticated attackers to log in as arbitrary users. The vulnerability affects all versions up to and including 2.0.0. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and log in as any user, potentially leading to full account compromise. This impacts confidentiality, integrity, and availability of user accounts and associated data within the affected WordPress plugin environment. The high CVSS score (8.1) indicates significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or restricting access to the WordPress environment to trusted users only. Monitor vendor communications for updates and apply patches promptly once available.