CVE-2026-28161

This CVE is a privilege escalation in the Service Finder Booking plugin where subscriber-level users can elevate themselves to administrator by manipulating booking management functions. The vulnerability isn't a single missed nonce or a broken conditional—it's a structural gap between what the developers believed they protected and what they actually protected. The core issue is authentication-versus-authorization conflation. WordPress distinguishes between these two concepts: authentication asks 'is this user logged in?' while authorization asks 'does this user have permission for this specific action?' The Service Finder developers checked the wrong gate. They likely added capability checks where they remembered to, but missed the AJAX endpoints, REST routes, or auxiliary functions that actually perform privilege-elevating actions. Subscribers can log in—so they pass the authentication check—and the developers stopped there. This pattern repeats across WordPress plugin families. Service Finder, Mega Addons, wp-file-manager, and others have produced the same access control failures across versions and years. This isn't random incompetence—it's a predictable output of how WordPress plugin development handles access control as a checkbox rather than a system boundary. The platform's `current_user_can()` function exists specifically to prevent this conflation, but the ecosystem teaches developers that authentication checks pass tests and ship features. Check your own plugins: audit every AJAX handler and REST route for explicit capability checks using `current_user_can()` with the minimum required capability—not just `is_user_logged_in()`. The vulnerability lives in the gaps between where developers remembered to check and where actions are actually dispatched. Look for booking management, user role assignment, or administrative functions that process requests from logged-in users without verifying the caller has permission to perform that specific operation.

Reviewed through automated stages and approved by a human before publication.