Critical · published April 25, 2025
🚨 An unauthenticated user can claim any role on your WordPress site—including Administrator—thanks to a sneaky oversight in the Service Finder Bookings plugin! 🔥 Think of it like a restaurant allowing anyone to walk in and grab a manager's uniform without checking credentials. This means someone could waltz in and start making decisions on the menu without any experience! This vulnerability could lead to an attacker gaining complete control over your site, allowing them to read sensitive data, modify content, or even bring the whole operation to a halt. Imagine a rogue chef serving up chaos in your establishment!
Think of it like a restaurant allowing anyone to walk in and grab a manager's uniform without checking credentials. This means someone could waltz in and start making decisions on the menu without any experience! The privilege escalation flaw in the Service Finder Bookings plugin allows unauthenticated users to register with any role, including Administrator, when using a social login, due to a lack of user role restrictions in the 'nsl_registration_store_extra_input' function.
This vulnerability could lead to an attacker gaining complete control over your site, allowing them to read sensitive data, modify content, or even bring the whole operation to a halt. Imagine a rogue chef serving up chaos in your establishment! Immediately update the Service Finder Bookings plugin to version 5.2 or later to close this vulnerability. Additionally, review your site roles and permissions to ensure no unauthorized access has occurred. Don't forget to enable monitoring for any suspicious registration activities! You've got this! With a quick update, you'll secure your site and keep those rogue chefs at bay! 🛡️