CVE-2025-5954

Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation

Published Aug 1, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.

Analysis

Technical impact

The Service Finder SMS System plugin for WordPress allows any internet user to register a new account without authentication, and the plugin does not limit the role that can be selected during registration. The flaw in the aonesms_fn_savedata_after_signup() function lets an attacker choose an administrator role, effectively creating a new admin account with full control over the site. This vulnerability is a classic privilege escalation via account takeover covered by CWE‑269, yielding complete compromise of confidentiality, integrity, and availability for the affected WordPress installation.

Affected Systems

All WordPress sites deploying the Service Finder SMS System plugin versions up to and including 2.0.0 are affected. The plugin is distributed by Aone Theme and appears in several WordPress theme marketplaces.

Risk and Exploitability

The CVSS score of 9.8 classifies this flaw as critical, and while the EPSS score of <1% indicates a very low probability of exploitation, the severity is high enough that it could be targeted by adversaries with modest resources. The vulnerability can be exploited by sending an unauthenticated HTTP registration request with a desired role of administrator. The vulnerability is not listed in CISA’s KEV catalog, but its impact justifies immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

aonetheme

Service Finder SMS System

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.0.0

No data.

Vendor	Product	Versions
Aonetheme	Service Finder Sms System	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Service Finder SMS System plugin to a version newer than 2.0.0 if available.
If no upgrade exists, temporarily disable new user registrations or block the /register endpoint until a fix can be applied.
Configure the WordPress security settings or use a role‑restriction plugin to prevent untrusted users from selecting high‑privilege roles during signup.

Generated by OpenCVE AI on April 21, 2026 at 19:31 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-23317	The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.468% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
https://www.wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve

History

Aug 4, 2025 9:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aonetheme Aonetheme service Finder Sms System Wordpress Wordpress wordpress
Vendors & Products		Aonetheme Aonetheme service Finder Sms System Wordpress Wordpress wordpress

Aug 1, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 1, 2025 2:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.
Title		Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
Weaknesses		CWE-269
References		https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793 https://www.wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`