The Service Finder SMS System plugin for WordPress allows any internet user to register a new account without authentication, and the plugin does not limit the role that can be selected during registration. The flaw in the aonesms_fn_savedata_after_signup() function lets an attacker choose an administrator role, effectively creating a new admin account with full control over the site. This vulnerability is a classic privilege escalation via account takeover covered by CWE‑269, yielding complete compromise of confidentiality, integrity, and availability for the affected WordPress installation.

All WordPress sites deploying the Service Finder SMS System plugin versions up to and including 2.0.0 are affected. The plugin is distributed by Aone Theme and appears in several WordPress theme marketplaces.

The CVSS score of 9.8 classifies this flaw as critical, and while the EPSS score of <1% indicates a very low probability of exploitation, the severity is high enough that it could be targeted by adversaries with modest resources. The vulnerability can be exploited by sending an unauthenticated HTTP registration request with a desired role of administrator. The vulnerability is not listed in CISA’s KEV catalog, but its impact justifies immediate attention.