Critical · 9.8 CVE-2025-23970 EUVD-2025-19966GHSA-pr95-fqhx-h72h

WordPress Service Finder Booking plugin <= 6.1 - Privilege Escalation Vulnerability

Published Jul 4, 2025 · Updated May 12, 2026 · Assigned by Patchstack

Vendor: Aonetheme Product: Service Finder Booking

Description

Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.

Affected products

Vendor	Product	Affected	Fixed
aonetheme	Service Finder Booking	≤ 6.1	—

References

https://patchstack.com/database/Wordpress/Plugin/sf-booking/vulnerability/wordpress-service-finder-booking-6-0-privilege-escalation-vulnerability?_s_id=cve vdb-entry