The Service Finder Bookings plugin for WordPress contains a privilege escalation vulnerability in all versions prior to 6.1. The flaw allows authenticated users with subscriber-level access or higher to change arbitrary users' email addresses without proper identity validation. This enables attackers to reset passwords and take over accounts, including administrator accounts.