CVE-2025-5955CWE-288

Service Finder SMS System <= 2.0.0 - Authentication Bypass

High · published September 19, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.5th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-09-19T04:27Z
EPSS history
Timeline
  • 19 SEP 04:27Z
    Service Finder SMS System <= 2.0.0 - Authentication Bypass
    cvelistv5