CVE-2025-6574: 
WordPress vulnerability analysis and mitigation

The Service Finder Bookings plugin for WordPress (CVE-2025-6574) is a high-severity vulnerability discovered and disclosed on October 31, 2025. This security flaw affects all versions of the plugin up to, but not including, version 6.1. The vulnerability was identified by researcher Thái An and received a CVSS score of 8.8, indicating its high severity (Wordfence).

The vulnerability stems from improper user identity validation within the plugin's user detail update functionality. The flaw specifically relates to the plugin's handling of email address updates, where it fails to properly authenticate user identity before allowing changes to critical user details (Tenable).

This vulnerability allows authenticated attackers with subscriber-level access or higher to perform privilege escalation through account takeover. Attackers can modify email addresses of arbitrary users, including administrators, which can then be leveraged to reset passwords and gain unauthorized access to these accounts (SecurityOnline).

Users are advised to update their Service Finder Bookings plugin to version 6.1 or later, which contains the fix for this vulnerability (Wordfence).