The Service Finder Bookings WordPress plugin is vulnerable to a severe authentication bypass that allows an unauthenticated attacker to assume the identity of any user, including administrators. The flaw resides in the service_finder_switch_back() function, which logs users in without properly validating a cookie value. An attacker can craft a malicious cookie to trigger this function, thereby gaining full access to site content, configuration, and data, which undermines confidentiality, integrity, and availability.

All versions of the Service Finder Bookings plugin provided by aonetheme up to and including 6.0 are affected. Any WordPress site that has installed these versions is vulnerable, and because the plugin is widely used through commercial theme marketplaces many sites worldwide may be impacted.

The CVSS score of 9.8 classifies this vulnerability as critical, and the EPSS score of 0.617% indicates a very low likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of a high severity rating, public disclosure, and widespread use signals imminent risk. The attack vector is inferred to be a web‑based cookie manipulation; an attacker only needs to set a crafted user_switch_cookie value in a browser or via a simple script to trigger the unauthorized login, making the exploit trivial for anyone with basic web skills. No additional host privileges or complex prerequisites are required beyond access to the target domain’s session handling.