Fave Themes Homey vulnerabilities

CVE-2024-12281 [CRITICAL] CWE-269 CVE-2024-12281: The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and inclu The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or

CVE-2025-0749 [HIGH] CWE-288 CVE-2025-0749: The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and includin The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.

CVE-2025-1326 [MEDIUM] CWE-862 CVE-2025-1326: The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing ca The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.

CVE-2025-1327 [MEDIUM] CWE-639 CVE-2025-1327: The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's accounts.

CVE-2025-0748 [MEDIUM] CWE-352 CVE-2025-0748: The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inc The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administr