Aonetheme Service Finder Sms System vulnerabilities
2 known vulnerabilities affecting aonetheme/service_finder_sms_system.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1
Vulnerabilities
Page 1 of 1
CVE-2025-5954P2CRITICALCVSS 9.8≤ 2.0.02025-08-01
CVE-2025-5954 [CRITICAL] CWE-269 CVE-2025-5954: The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attack
nvd
CVE-2025-5955P3HIGHCVSS 8.1≤ 2.0.02025-09-19
CVE-2025-5955 [HIGH] CWE-288 CVE-2025-5955: The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all ver
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
nvd