High severity · published Mar 7, 2025
CVE-2025-0749
Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
Homey · Fave Themes
through 2.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0749
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0749
favethemes.zendesk.com
https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/05f87510-28c3-4ad1-b2be-2408a199cf68?source=cve
More from Homey
9.8
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
4.3
CVE-2025-1326
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
4.3
CVE-2025-1327
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion
4.3
CVE-2025-0748
Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification