The Service Finder Bookings WordPress plugin allows unauthenticated users to claim any business through the claim_business AJAX action without proper identity validation. This flaw enables an attacker to assume the identity of any user, including administrators, effectively performing an account takeover. The vulnerability is a classic case of privilege escalation as defined by CWE-639, where privileged operations are performed without proper authorization checks.

WordPress sites running the Service Finder Bookings plugin from aonetheme with versions up to and including 6.0 are impacted. All installations of the plugin regardless of additional security plugins or custom modifications remain vulnerable unless the plugin is upgraded beyond version 6.0.

The flaw carries a CVSS score of 9.8, indicating critical severity, but the EPSS score is less than 1%, suggesting exploit attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated attacker sending the claim_business action to the plugin's AJAX endpoint, which then accepts the supplied claim_id. Successful exploitation requires an attacker to acquire a valid claim ID—either by brute‑forcing or by leveraging a subscriber‑level account—making the attack more complex than a simple direct login. Once a valid claim ID is obtained, the attacker can log in as the target user, including admin accounts.