Access violation vulnerability in Service Finder Bookings 6.0

The Service Finder Bookings plugin for WordPress has a security issue that allows attackers to gain more privileges by taking over someone else’s account. This can happen in all versions of the plugin up to version 6.0. The problem is that the plugin doesn’t check if the person requesting a password change is actually who they say they are. Because of this, people with subscriber access or higher can reset the passwords of other users, even administrators.