Critical severity · published Mar 5, 2025
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or Shop Manager role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
Homey · Fave Themes
through 2.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12281
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12281
themeforest.net
https://themeforest.net/item/homey-booking-wordpress-theme/23338013
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3b93c33c-4ab1-48a2-b84d-3cb38ccea829?source=cve
More from Homey
8.1
CVE-2025-0749
Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
4.3
CVE-2025-1326
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
4.3
CVE-2025-1327
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion
4.3
CVE-2025-0748
Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification