The Service Finder Bookings plugin for WordPress up to version 6.0 contains a privilege escalation vulnerability that allows authenticated users with subscriber or higher roles to reset passwords of other users, including administrators. This occurs because the plugin fails to properly validate user identity before processing password change requests.