The Service Finder Bookings plugin for WordPress allows an authenticated user with subscriber level access or higher to modify any user’s email address. Because the plugin does not verify the identity of the user making the change, a malicious account can change the email of an administrator or other privileged user, trigger a password reset, and take control of that account. This flaw allows an attacker to update any user’s email address and potentially take over their account via password reset. The weakness is an identity validation failure, classified as CWE‑639.

This issue affects the Service Finder Bookings WordPress plugin from aonetheme for all released versions prior to 6.1. Any WordPress installation using these older plugin versions is susceptible.

The vulnerability carries a CVSS score of 8.8, indicating high potential impact. However, the EPSS score is below 1%, suggesting that exploitation is currently uncommon. The flaw is not listed in the CISA KEV catalog. An attacker must already be authenticated with a subscriber or higher role, then use the plugin’s user‑management interface to modify another user’s email. Once the email is changed, the attacker can initiate a password reset and gain administrative access.