Threat actors are aggressively exploiting a critical authentication bypass flaw in the Service Finder WordPress theme and its bundled Service Finder Bookings plugin, allowing them to log in as any user (including administrators) without valid credentials and seize full control of vulnerable sites. The flaw, tracked as CVE-2025-5947 (CVSS 9.8/10), was discovered by researcher “Foxyyy,” and stems from improper validation of the “original_user_id” cookie in the “service_finder_switch_back()” function, enabling privilege escalation and site hijacking. All versions up to and including 6.0 are affected, with a patch issued on July 17, 2025, however active exploitation began shortly after public disclosure. Since August 1, Wordfence has recorded over 13,800 attack attempts, with daily spikes exceeding 1,500 starting September 23, primarily from five (5) IP addresses. Attackers typically use a simple HTTP GET request with the “switch_back=1” parameter to impersonate users, potentially inserting malicious redirects, hosting malware, or deleting logs to conceal activity. CTIX analysts urge administrators to follow Wordfence guidance by blocklisting known IPs, reviewing logs for suspicious actions, updating immediately to the patched version, and remaining vigilant, as exploitation remains widespread and the absence of log entries does not guarantee a site is uncompromised.