Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Service Finder WordPress theme active auth bypass exploitation wave (CVE-2025-5947)

Exploitation Wave
First reported
Last updated
Happening score
H score 67
2 unique sources, 2 articles

Summary

Hide ▲

CVE-2025-5947 is being exploited at scale against the Service Finder WordPress theme, with attackers using an authentication bypass to log in as administrators and take over affected sites. Wordfence saw more than 13,800 attempts since August 1, including a surge of over 1,500 per day for about a week starting September 23. The flaw affects Service Finder versions 6.0 and older, and the vendor fixed it in version 6.1. The wave matters because successful abuse gives attackers full WordPress control, including account creation, PHP uploads, and database export.

Related Happenings

WP Maps Pro unauthenticated admin-account-creation flaw (CVE-2026-8732)

Vulnerability
H score44 First: 31.05.2026 17:06 Last: 31.05.2026 17:06 Sources 1

About this happening: WP Maps Pro versions 6.1.0 and older contain CVE-2026-8732, an unauthenticated flaw that can create rogue administrator accounts and lead to full WordPress s...

Open Happening

OpenDCIM multi-flaw exploitation wave (CVE-2026-28515, CVE-2026-28516, CVE-2026-28517)

Exploitation Wave
H score46 First: 17.05.2026 14:57 Last: 17.05.2026 14:57 Sources 1

About this happening: openDCIM is seeing an active exploitation wave tied to CVE-2026-28515, CVE-2026-28516, and CVE-2026-28517, with attackers targeting vulnerable installations an...

Open Happening

Burst Statistics authentication bypass (CVE-2026-8181)

Vulnerability
H score78 First: 15.05.2026 00:07 Last: 15.05.2026 00:07 Sources 1

About this happening: Burst Statistics on WordPress sites is facing active exploitation of CVE-2026-8181, a critical authentication bypass that can let unauthenticated attackers imperso...

Open Happening

Breeze Cache unauthenticated file-upload flaw (CVE-2026-3844)

Vulnerability
H score20 First: 24.04.2026 00:33 Last: 24.04.2026 00:33 Sources 1

About this happening: Active exploitation of CVE-2026-3844 in the Breeze Cache WordPress plugin puts sites running versions up to 2.4.4 at risk of unauthenticated arbitrary file upload,...

Open Happening

TP-Link router authenticated command injection (CVE-2023-33538)

Vulnerability
H score27 First: 20.04.2026 10:50 Last: 20.04.2026 10:50 Sources 1

About this happening: CVE-2023-33538 in discontinued TP-Link routers is still being probed, leaving exposed devices at risk of arbitrary command execution and denial of service if attac...

Open Happening

Timeline

  1. 08.10.2025 18:57 3 articles · 9mo ago

    Wordfence reports active exploitation and switch_back IOCs

    Detection Ioc Update

    Wordfence reports active exploitation of CVE-2025-5947 against the Service Finder WordPress theme, with more than 13,800 exploit attempts since August 1 and a surge of more than 1,500 attack attempts every day for about a week since September 23. Typical attacks use an HTTP GET request to the root path with `switch_back=1`, and the only clear indicator of compromise is a request containing the `switch_back` parameter.

    Show sources
    Open in new tab
  2. 17.07.2025 03:00 1 articles · 12mo ago

    Aonetheme releases Service Finder 6.1 fixing CVE-2025-5947

    Mitigation Patch Update

    Aonetheme releases Service Finder version 6.1 on July 17 to address the security issue affecting Service Finder versions 6.0 and older, closing the authentication-bypass weakness in `service_finder_switch_back()`.

    Show sources
    Open in new tab
  3. 08.06.2025 03:00 1 articles · 13mo ago

    Foxyyy reports CVE-2025-5947 through Wordfence

    Initial Disclosure

    Security researcher 'Foxyyy' reports CVE-2025-5947 through Wordfence's bug bounty program on June 8, identifying an authentication-bypass flaw in Service Finder that can let an attacker log in as an administrator.

    Show sources
    Open in new tab