Description
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
Published: 2025-05-02
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Deletion by Authenticated Users
Action: Update Theme
AI Analysis

Impact

The Homey WordPress theme is vulnerable because its homey_reservation_del() function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to delete any reservation or post. This enables attackers to erase booking data, potentially causing loss of revenue, disrupting service, and eroding user trust. The flaw is a classic example of missing authorization, identified as CWE-862.

Affected Systems

The vulnerability affects the Homey booking and rentals WordPress theme from Fave Themes, versions 2.4.4 and earlier. Any WordPress site installing these theme versions is susceptible.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is below 1%, suggesting low likelihood of exploitation. Attacks require a valid authenticated account with Subscriber-level permissions or higher, and exploitability hinges on the theme’s deletion function. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation at the time.

Generated by OpenCVE AI on April 20, 2026 at 23:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Homey theme to version 2.4.5 or later, which includes the missing capability check.
  • If an upgrade is not immediately possible, remove or restrict the delete_post and delete_others_post capabilities from the Subscriber role to prevent reservation or post deletion.
  • Monitor site logs for unexpected reservation or post deletions and audit user activity following the update.

Generated by OpenCVE AI on April 20, 2026 at 23:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-13293 The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
History

Tue, 06 May 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Favethemes
Favethemes homey
CPEs cpe:2.3:a:favethemes:homey:*:*:*:*:*:wordpress:*:*
Vendors & Products Favethemes
Favethemes homey

Fri, 02 May 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 May 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
Title Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Favethemes Homey
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:19:44.523Z

Reserved: 2025-02-14T23:46:22.758Z

Link: CVE-2025-1326

cve-icon Vulnrichment

Updated: 2025-05-02T16:18:25.813Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-02T04:15:46.530

Modified: 2025-05-06T15:27:38.483

Link: CVE-2025-1326

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T23:15:06Z

Weaknesses