PT-2025-10027

Name of the Vulnerable Software and Affected Versions Homey theme for WordPress versions up to and including 2.4.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the homey verify user manually function. This allows unauthenticated...

PT-2025-10028

Name of the Vulnerable Software and Affected Versions Homey theme for WordPress versions up to and including 2.4.3 Description The issue allows for authentication bypass due to the verification id value being set to empty and a missing not empty check in the dashboard user profile page. This...

CVE-2025-0749: Authentication Bypass Using an Alternate Path or Channel

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificationid' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers t...