CVE-2025-1326 Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2025-1326

CVE-2025-1326 affects the Homey WordPress theme (versions up to 2.4.4). Root cause: missing capability check in the function homey_reservation_del(), enabling authenticated attackers with Subscriber-level access and above to delete arbitrary reservations and posts. Impact: unauthorized modificati...

CVE-2025-1327 Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion

The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homeydeleteuseraccount' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2025-1327

CVE-2025-1327 affects the Homey WordPress theme (versions ≤ 2.4.4). The vulnerability is an Insecure Direct Object Reference via the homey_delete_user_account action, caused by missing validation on a user-controlled key. This allows authenticated attackers with Subscriber-level access or higher ...

PT-2025-18756 · WordPress · Homey

Name of the Vulnerable Software and Affected Versions: Homey theme for WordPress versions up to, and including, 2.4.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete other users' accounts due to missing validation on a user-controlled key in...

PT-2025-18755 · WordPress · Homey

Name of the Vulnerable Software and Affected Versions: Homey theme for WordPress versions prior to 2.4.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete arbitrary reservations and posts due to a missing capability check on the homey reservati...

WordPress Homey theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Deletion vulnerability discovered by a00n in WordPress Theme Homey versions = 2.4.4...

WordPress Homey Theme <= 2.4.4 is vulnerable to Broken Access Control

Software Homey Type Theme Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-1326 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f04df5696a52 Credits a00n Required privilege Subscriber...

WordPress Homey Theme <= 2.4.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Homey Type Theme Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Insecure Direct Object References IDOR CVE CVE-2025-1327 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8b4f513f58e Credits a00...

CVE-2024-51800

CVE-2024-51800 describes an Incorrect Privilege Assignment vulnerability in Favethemes Homey (WordPress theme/plugin) that enables Privilege Escalation. The issue affects Homey versions from an unknown start through 2.4.1. The connected Red Hat advisory and Red Hat security notes align with the C...

CVE-2024-51800 WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1...

CVE-2025-0748

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homeyverifyusermanually' function. This makes it possible for unauthenticated attackers to update verify an user via a...

CVE-2024-12281

The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by...

CVE-2025-0748

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homeyverifyusermanually' function. This makes it possible for unauthenticated attackers to update verify an user via a...

CVE-2025-0749

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificationid' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers t...

CVE-2025-0748

CVE-2025-0748 refers to the Homey WordPress theme vulnerability. The Homey theme (WordPress) versions up to and including 2.4.3 are exposed to a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation in the homey_verify_user_manually function. This allows unauthenticated atta...

CVE-2025-0748 Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homeyverifyusermanually' function. This makes it possible for unauthenticated attackers to update verify an user via a...

CVE-2025-0748 Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homeyverifyusermanually' function. This makes it possible for unauthenticated attackers to update verify an user via a...

CVE-2025-0749 Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificationid' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers t...

CVE-2025-0749 Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificationid' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers t...