xxconi/CVE-2025-5947

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-5947, an authentication bypass in the Service Finder Bookings WordPress plugin, by sending a crafted cookie to log in as any user including admins.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit script for CVE-2025-5947, a README, and a requirements file. The exploit script sends a crafted cookie to a target WordPress site to trigger an authentication bypass vulnerability. No backdoor, concealed payload, or operator-directed harm was observed. The script performs only the advertised exploit behavior.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPressService Finder Bookings plugin (sf-booking)
Attack typesAuthentication BypassPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted HTTP requests to exploit the vulnerability and gain unauthorized access, which is the definition of an exploit. It does not merely detect or report the vulnerability.

CVE-2025-5947.py:49-94CVE-2025-5947.py:10

Requirements

  • Target must have the vulnerable Service Finder Bookings plugin (<= 6.0) installed and the service_finder_switch_back AJAX action accessible.CVE-2025-5947.py:33-43CVE-2025-5947.py:60-66

Observed behavior

  • Sends a GET request to /wp-admin/admin-ajax.php?action=service_finder_switch_back with a cookie original_user_id set to a target user ID, attempting to log in as that user.CVE-2025-5947.py:55-66
  • Checks for success indicators: HTTP 301/302 redirect, Location header containing /wp-admin/, and Set-Cookie header containing wordpress_logged_in_.CVE-2025-5947.py:75-79
  • Includes a brute-force mode that iterates over a range of user IDs to find valid accounts.CVE-2025-5947.py:96-123
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends HTTP GET request to /wp-admin/admin-ajax.php with cookie original_user_id set to a user-supplied ID and action=service_finder_switch_backThis is the documented exploit for CVE-2025-5947 authentication bypass. No additional requests or payloads are sent.CVE-2025-5947.py:55-66
Network Target
User-supplied target URL via -u/--url argumentThe script only connects to the target specified by the operator. No hardcoded external addresses or exfiltration endpoints are present.CVE-2025-5947.py:138
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code and README; no runtime execution or network traffic was observed.
  • The exploit's effectiveness depends on the target's configuration and the presence of the vulnerable plugin version.
  • No binary files were present in the artifact.
  • Review is limited to the supplied text content; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1