CVE-2025-2470: Aonetheme Service Finder Bookings

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.

Affected products

• Aonetheme Service Finder Bookings: up to and including 5.1

Published 2025-04-25. Last modified 2026-06-17.