The Service Finder Booking plugin for WordPress contains an incorrect privilege assignment flaw (CWE‑266) that permits an attacker to elevate privileges to an administrator level, thereby gaining full control over the site’s content, configuration, and user accounts. The flaw is identified as a high‑severity vulnerability with a CVSS score of 9.8, underscoring the potential for significant security compromise if exploited.

The vulnerability affects the aonetheme Service Finder Booking plugin in all releases up to and including version 6.1. Any WordPress site that has installed a version of the plugin that is 6.1 or earlier is susceptible to privilege escalation through this flaw.

The CVSS score of 9.8 indicates a severe risk of complete site compromise. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no large‑scale exploitation has been reported. Based on the description, the likely attack vector involves exploiting the plugin’s administrative endpoints from an account or user session that can trigger the role‑assignment logic, either via authenticated requests or by exploiting a misconfiguration that allows unauthenticated access to the vulnerable functionality.