Critical · published August 1, 2025
🚨 An unauthenticated attacker could easily log in as any user, including admins, with a simple cookie trick! 🔥 Think of this as a restaurant where anyone can simply swipe someone else's reservation without any verification — they can sit at the table and order whatever they want, all while pretending to be someone else. This flaw allows a malicious actor to take control of any user account, potentially leading to data theft, unauthorized changes, or even complete site takeover. Imagine an intruder having the keys to the backroom, able to change orders and access sensitive information. Absolutely devastating!
Think of this as a restaurant where anyone can simply swipe someone else's reservation without any verification — they can sit at the table and order whatever they want, all while pretending to be someone else. The vulnerability in the Service Finder Bookings plugin occurs because it does not adequately validate a user's cookie value during the login process via the service_finder_switch_back() function, allowing unauthenticated users to log in as any account.
This flaw allows a malicious actor to take control of any user account, potentially leading to data theft, unauthorized changes, or even complete site takeover. Imagine an intruder having the keys to the backroom, able to change orders and access sensitive information. Absolutely devastating! Patch to version 6.0.1 or later immediately! Additionally, review user permissions and consider implementing stricter cookie validation to prevent unauthorized access. Don't take chances with your user data! You've got this! Follow these steps and you'll have your website locked down in no time. 🛡️