Description

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:16:58.737Z",
  "pubdate": "2026-08-13T14:16:58.737Z",
  "executiveSummary": "A broken access control vulnerability has been identified in the Service Finder Booking plugin for WordPress, specifically affecting all versions up to and including 6.2. This security flaw introduces significant risk by allowing unauthorized users, specifically those authenticated with subscriber-level privileges, to access, modify, or interact with administrative or restricted functionalities that should be strictly segregated based on user roles. The vulnerability stems from insufficient authorization checks within the application logic, enabling low-privileged threat actors to bypass intended security boundaries. Successful exploitation of this flaw can lead to unauthorized data exposure, privilege escalation, or unauthorized modification of system resources depending on the exposed endpoints. An attacker requires a valid subscriber account on the target WordPress instance to initiate exploitation, requiring no complex user interaction beyond issuing crafted requests to the vulnerable functions. The risk implication is severe for organizations utilizing the affected plugin, as it undermines the core principle of least privilege and compromises the overall integrity and confidentiality of the hosted booking system.",
  "technicalDetails": "The vulnerability resides within the access control enforcement mechanisms of the Service Finder Booking plugin <= 6.2. Specifically, the root cause is the absence of robust capability checks and nonce verification within the request-handling functions exposed to authenticated users. In WordPress architecture, plugins must explicitly validate user roles and capabilities using functions such as current_user_can() and verify cryptographic nonces to ensure that incoming HTTP requests originate from authorized contexts.\nIn the case of Service Finder Booking <= 6.2, certain administrative or privileged AJAX actions, REST API endpoints, or backend functions fail to validate whether the executing user possesses the requisite administrative or managerial capabilities. Consequently, a user authenticated with a low-privilege role, such as a subscriber, can invoke these sensitive backend functions simply by dispatching HTTP POST or GET requests directly to the vulnerable endpoints.\nThe attack flow proceeds as follows: First, the attacker registers or authenticates as a standard subscriber on the target WordPress site to obtain a valid session cookie. Second, the attacker identifies the exposed vulnerable endpoints or AJAX action hooks utilized by the plugin to manage bookings, settings, or user data. Third, the attacker crafts a malicious HTTP request targeting these functions, bypassing the user interface entirely. Because the backend code lacks proper privilege validation, it processes the request as if it were issued by an administrator or authorized manager.\nThe vulnerable component comprises the backend request handlers and routing mechanisms of the plugin. The network exposure is remote, as the endpoints are accessible via standard HTTP/HTTPS protocols exposed by the WordPress web server. The payload behavior involves executing unauthorized database queries, modifying booking statuses, or accessing sensitive user information normally restricted to higher privilege levels. The post-exploitation impact includes unauthorized data manipulation, potential information disclosure, and disruption of booking operations."
}