Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)

In the autumn of 2025, a critical authentication bypass vulnerability (CVE-2025-5947) was discovered and actively exploited in the Service Finder WordPress theme, affecting versions 6.0 and older. Attackers leveraged improper validation in the 'service_finder_switch_back()' function, allowing them to impersonate any user—including administrators—simply by sending HTTP requests with a crafted cookie or query parameter. The flaw enabled threat actors to gain full administrative control over thousands of websites, with over 13,800 exploitation attempts recorded by Wordfence since August 1. Attackers could then create or modify site content, add malicious code, or export sensitive data undetected, putting site owners and users at risk.

This breach is particularly relevant as it illustrates the continued targeting of WordPress ecosystems with privilege escalation exploits, highlighting growing risks from vulnerable third-party themes and plugins. It underscores the urgency of rapid patching, improved logging, and continuous monitoring to defend against evolving web application threats.

The Service Finder exploit demonstrates the risk of supply chain vulnerabilities within popular web platforms, with attackers moving swiftly to exploit newly disclosed flaws at scale. Active exploitation is ongoing, requiring immediate patching and heightened vigilance by administrators to prevent further unauthorized access, data theft, or stealthy persistence on affected sites.