The Homey WordPress theme is vulnerable to an Insecure Direct Object Reference that allows authenticated users with Subscriber-level access or higher to delete other users’ accounts by exploiting the 'homey_delete_user_account' action. This denial of service to users can lead to data loss, user frustration, and potential cascading effects on any services relying on those accounts. The weakness stems from missing validation on a user‑controlled key, a classic case of CWE‑639: Authorization Bypass Through User‑Controlled Key.

Affecting the Homey theme from Fave Themes, all versions through 2.4.4. Any WordPress installation that includes this theme without an update is exposed. The flaw exists regardless of WordPress core version, as it is built into the theme’s code.

With a CVSS score of 4.3, the flaw is of moderate severity. The EPSS score is under 1 %, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack can be performed by simply crafting a request to the deletion endpoint while authenticated as a Subscriber+, implying an authenticated IDOR that requires only basic access to the site’s admin interface.