Hackers Take Over Your WordPress Without Knowing the Password

A critical vulnerability in WordPress tracked as CVE-2025–5947 with a CVSS score of 9.8 was recently discovered. This is a flaw in the Service Finder Bookings plugin, which is part of the premium Service Finder template. This vulnerability allows attackers to completely bypass authentication and gain control over the administrator account on the compromised website.

The vulnerability stems from insufficient validation of cookie values in the implementation of the account switching function (service_finder_switch_back). An attacker can simply take over the identity of any user — including the administrator — by modifying the original_user_id cookie, without knowing their login credentials.

All versions of the plugin up to and including version 6.0 are vulnerable. It’s alarming that massive attacks occurred within the first days after the details were published — over 13,800 exploitation attempts were detected in just one week. Attackers typically gain complete control over the website, manipulate content, upload malicious files, or install additional plugins.

Website owners with the Service Finder Bookings plugin are therefore strongly advised to immediately update to the latest version of the plugin. At the same time, it’s necessary to review web logs for suspicious requests, especially those containing the switch_back parameter. Non-standard changes in user accounts and plugin files may also be indicators of compromise.

RediShell: Critical Vulnerability in Redis Survived 13 Years

The vulnerability designated CVE-2025–49844 (with a CVSS score of 10.0), nicknamed RediShell, ranks among the most serious vulnerabilities in Redis project history. This is a flaw that survived in the code of the most popular open-source in-memory database system for over 13 years, until its discovery by the Wiz team.

The essence of the vulnerability is a use-after-free bug in the Lua scripting engine. An attacker who gains authenticated access to a Redis instance can send a specially crafted Lua script that triggers the garbage collector in a modified mode, and subsequently break out of the scripting engine sandbox. As a result, they can remotely execute arbitrary code on the server and escalate their privileges.

The practical consequences are severe: compromising a Redis instance can lead to data exfiltration, malware deployment, theft of credentials or tokens from cloud environments, and permanent infrastructure compromise. Especially in public cloud environments, where Redis often runs without strong authentication and in open containers, not only the instance itself is at risk, but also connected applications and services.

Redis developers reacted quickly and released updates in several branches (8.2.2, 8.0.4, 7.4.6, 7.2.11). Administrators are advised to immediately deploy security patches. Where updates are not possible, risk can at least be reduced — for example, by restricting access to Redis using network rules (firewall), disabling Lua scripting using ACL rules, or at least setting strong authentication and monitoring activities.

Command Injection in Figma MCP

A vulnerability tracked as CVE-2025–53967 with a CVSS score of 7.5 was discovered in the Figma MCP server.

The vulnerability originated in the fetch-with-retry.ts file, where a system curl command was used in case of primary API communication failure. Values such as URL or HTTP headers, originating from the user, were passed to the child_process.exec function without proper validation. This implementation allowed an attacker to inject shell metacharacters or additional commands into the parameters, leading directly to code execution on the server with MCP server privileges.

In case of exploitation, an attacker could fully compromise the MCP server, collect data, modify designs, or potentially attack other systems on the network. At risk were not only user data, but also workflow integrity and intellectual property of companies using Figma, including AI agents connected via MCP.

The manufacturer released a fix in version 0.6.3: the exec function was replaced with the safer execFile function. At the same time, input validation was extended and detailed API call logging was introduced for better monitoring of suspicious activities.

Critical Vulnerability in Oracle EBS

Oracle had to urgently release a patch for a critical vulnerability tracked as CVE-2025–61882 with a CVSS score of 9.8 in the E-Business Suite platform.

The essence of the vulnerability lay in an easily exploitable chain of weaknesses that together allowed an unauthenticated attacker to remotely execute arbitrary code on the server. Exploitation began with an SSRF attack via the /OA_HTML/configurator/UiServlet endpoint with unauthorized parameter manipulation, continued through CRLF injection and exploitation of XSLT transformations in BI Publisher to execute commands at the JVM level. Attackers also used tricks with persistent HTTP connections for more reliable transmission of malicious payloads.

During August and September 2025, massive internet scanning targeting Oracle EBS instances was monitored, with hundreds of organizations infected even before the patch was released. According to security reports, a large amount of data was exfiltrated — from personal information to financial and contractual documents. Various ransomware groups then used the obtained data for extortion, or for further hacking attacks through lateral movement across networks.