On August 1, 2025, cybersecurity researchers confirmed that threat actors began actively exploiting a critical authentication bypass vulnerability in the Service Finder Bookings WordPress plugin, putting more than 6,000 purchased installations at risk of complete administrator takeover. The vulnerability, tracked as CVE-2025-5947, carries a CVSS severity score of 9.8 out of 10, placing it firmly in the critical category.
The Threat Landscape
The Service Finder theme and its bundled Bookings plugin serve thousands of businesses worldwide that rely on WordPress for service booking functionality. The vulnerability was discovered by a researcher operating under the handle Foxyyy, who reported it through the Wordfence Bug Bounty Program. The flaw resides in how the plugin handles an account switching function, specifically failing to validate whether session cookies presented during authentication requests are legitimate.
An attacker needs nothing more than a crafted HTTP request containing a falsified administrator cookie to bypass all authentication mechanisms. No valid credentials, no prior access, and no special tools are required. The exploit works against any unpatched installation running version 6.0 or earlier of the Service Finder theme.
Wordfence reports that over 13,800 exploit attempts have been recorded since active exploitation began on August 1. The plugin maintainers had already released a patch in version 6.1 on July 17, but the gap between patch availability and active exploitation left thousands of sites vulnerable.
Core Principles
This incident illustrates several fundamental security principles that apply across both traditional web platforms and the broader cryptocurrency ecosystem. First, trust but verify: any authentication mechanism that accepts external data without rigorous validation is inherently broken. The Service Finder plugin trusted cookie data from HTTP requests without confirming its authenticity through server-side validation.
Second, the patching gap remains one of the most exploited windows in cybersecurity. Even when vendors release fixes promptly, the time between patch availability and actual deployment creates a vulnerability window that attackers actively monitor and exploit. In this case, the two-week gap between the July 17 patch and the August 1 exploitation start date gave attackers a clear roadmap of what to target.
Third, the convergence of web application vulnerabilities with cryptocurrency operations amplifies risk. Many crypto platforms, exchanges, and DeFi projects run on WordPress or similar CMS platforms. A website compromise can lead to malicious JavaScript injection, phishing page deployment, or direct theft of API keys and credentials stored in site configurations.
Tooling and Setup
Protecting against this class of vulnerability requires a layered security approach. Start with a Web Application Firewall, which is exactly what stopped many of the 13,800 recorded exploit attempts. Wordfence’s firewall detected the malicious cookie patterns and blocked requests before they reached the vulnerable plugin code.
Implement automated patch management for all WordPress components. Plugins and themes should be set to auto-update, or at minimum, security patches should be applied within 24 hours of release. For organizations managing multiple WordPress installations, centralized patch management tools can enforce update policies across all properties.
Deploy integrity monitoring that alerts on unexpected file changes, new administrator accounts, or modifications to core WordPress files. These indicators often signal a successful exploitation attempt that bypassed perimeter defenses.
Ongoing Vigilance
The CVE-2025-5947 exploitation campaign demonstrates that attackers are systematically scanning for newly disclosed vulnerabilities within days of patch release. Security researchers observed that exploitation began almost immediately after the patch became publicly available, suggesting that threat actors monitor security advisories as closely as defenders do.
Gunter Ollmann, CTO at security firm Cobalt, warned that compromised WordPress installations can serve as pivots for broader attacks including malware distribution, credential theft, and botnet recruitment. For crypto businesses specifically, a compromised website could serve as a delivery mechanism for wallet-draining malware or fake wallet downloads.
Final Takeaway
The Service Finder vulnerability is a textbook example of why defense-in-depth matters. No single security control is sufficient. Combine timely patching with web application firewalls, integrity monitoring, and regular security audits. For cryptocurrency users and businesses, recognize that your website security is part of your overall security posture. A wallet is only as safe as the infrastructure surrounding it.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals for specific guidance.
CVE-2025-5947 and 13800 exploit attempts in days. any crypto site running WordPress with booking plugins is basically serving their wallet keys on a platter
CVSS 9.8 means remote unauthenticated admin takeover. on 6000 sites. and the patch was available weeks before active exploitation started
Diego R. the patch-to-deploy gap is where people lose money. site owners running critical infrastructure who dont enable auto-updates for security patches are asking for it
CVSS 9.8 and all it takes is a fake cookie. imagine running a bookings plugin on 6000 sites and nobody audited the session handling until someone named Foxyyy stumbled on it
patch_notes_42 session cookie validation missing on an account switching function is day one OWASP stuff. how does a plugin with 6000 paid installs skip basic auth review
This is exactly the kind of development the space needs
ProofOfWork_ CVE-2025-5947 with a 9.8 CVSS score on a plugin with 6000 installations. any crypto site running WordPress needs automated patch management
Luca Moretti CVSS 9.8 on a booking plugin is insane. 6000 sites and probably 40 percent never patched. WP plugin ecosystem is a security nightmare
CVSS 9.8 on 6000 installs and the researcher who found it is named Foxyyy. wordfence bounty program is the only reason this didnt become a mass breach
Wordfence bounty program finding this before threat actors mass-exploited it is the only good news here. 6000 installs is small compared to what could have happened if this was a popular ecommerce plugin
account switching without validating session cookies is the kind of bug that should get you fired from a security review. this is OWASP day one stuff
cookie_monster_ the 13800 attack attempts prove the window was wide open. half those sites probably still havent patched
cookie_monster_ the 13800 attack attempts prove the window was wide open. half those sites probably still havent patched
The fundamental value proposition of crypto keeps getting stronger
Interesting perspective — I hadn’t considered that angle before
Education is still the biggest barrier to mainstream adoption
The best projects are the ones quietly shipping during bear markets
CVSS 9.8 on a booking plugin used by 6,000 sites and half of them probably dont even know theyre vulnerable. automatic updates should be mandatory for critical vulns
Tomasz J. automatic updates for critical vulns would fix this but the WP ecosystem is too fragmented. every site is basically a custom snowflake with 30 plugins
a single forged cookie taking over admin on 6,000 sites. WordPress ecosystem needs mandatory security audits for any plugin with over 1,000 installs
13800 exploit attempts in days and the patch was available weeks before. the gap between patch and deploy is where the real damage happens
a single forged cookie taking over 6000 sites and the patch sat there for weeks. WP admins are their own worst enemy
a single forged cookie taking over 6000 sites and the patch sat there for weeks. WP admins are their own worst enemy
wp_sec_ops the patch gap is insane. 13,800 exploit attempts and probably half those sites still havent updated. WP plugin security is a dumpster fire