Description

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T14:16:58.887Z",
  "pubdate": "2026-08-13T14:16:58.887Z",
  "executiveSummary": "A privilege escalation vulnerability exists in the Service Finder Booking plugin affecting versions <= 6.2. This security flaw allows authenticated users with low-privilege Subscriber accounts to escalate their privileges within the WordPress environment. The vulnerability arises from improper access controls and insufficient authorization checks within the plugin's request handling mechanisms. An attacker possessing baseline Subscriber credentials can exploit this vector to execute unauthorized administrative actions or acquire higher-level privileges, severely compromising the confidentiality, integrity, and availability of the underlying web application. The risk implications include complete site takeover, unauthorized modification of sensitive system settings, and potential execution of arbitrary administrative tasks. Exploitation requires the attacker to possess a valid Subscriber-level account on the target WordPress instance, coupled with the ability to interact with the vulnerable endpoints exposed by the Service Finder Booking plugin. No complex user interaction is strictly required beyond the initial authentication state, making automated exploitation feasible once initial access is achieved.",
  "technicalDetails": "The vulnerability resides in the access control implementation of the Service Finder Booking plugin for versions <= 6.2. Specifically, the root cause stems from the application failing to properly validate user capabilities and roles prior to executing privileged functions or updating user meta and role assignments. In WordPress architectures, AJAX actions, REST API endpoints, or custom form submission handlers must strictly verify nonces and execute capability checks such as current_user_can() to ensure the requesting user possesses the requisite authorization for the requested operation.\nDuring the attack flow, a malicious actor authenticated with standard Subscriber privileges crafts a specialized HTTP request targeting the vulnerable component within the Service Finder Booking plugin. Because the underlying code lacks adequate authorization enforcement, the application processes the incoming parameters without validating whether the current session holds administrator or manager capabilities. The payload behavior involves submitting manipulated parameters designed to alter user privilege states, such as injecting administrative roles or modifying user capability arrays stored in the database.\nThe affected components comprise the backend request handlers and function routines responsible for processing booking management or user role configurations within Service Finder Booking <= 6.2. The network exposure is constrained to the web application surface, requiring network connectivity to the target's HTTP/HTTPS interface. Authentication is required, but it is restricted to the lowest tier (Subscriber), bypassing intended authorization boundaries designed to separate subscriber functions from administrative controls.\nThe post-exploitation impact includes full administrative compromise of the WordPress instance. Once privilege escalation is achieved, the attacker can install arbitrary plugins and themes, upload malicious web shells, modify core application files, extract sensitive database contents including user credentials, and pivot further into the hosting infrastructure. Remediation requires strict enforcement of capability checks and proper nonce validation across all internal routing and execution handlers within the plugin codebase."
}