Approved changes feed: RSS · Atom

cpe:2.3:a:aonetheme:service_finder_sms_system:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorAonetheme (25ff811f-3734-52ee-b524-bb978393357a)
ProductService Finder Sms System (2bffdf01-122c-5ddb-a87e-3b337c92da16)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-5955 vulnerable 2026-06-08 07:37:26.140289 Service Finder SMS System <= 2.0.0 - Authentication Bypass
HIGH (8.1)
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
Published: 2025-09-19T04:27:05.107Z
Updated: 2026-04-08T17:23:42.395Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-5954 vulnerable 2026-06-08 07:37:26.139992 Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
CRITICAL (9.8)
The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user.
Published: 2025-08-01T02:24:17.625Z
Updated: 2026-04-08T16:52:42.864Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.