The Homey WordPress theme contains an SQL injection flaw that arises from improper handling of user-supplied data in SQL statements. The vulnerability can allow an attacker to execute arbitrary SQL commands against the database, potentially exposing sensitive content or enabling further exploitation of the website. The weakness is a classic input validation failure, classified as CWE‑89.

The flaw affects instances of the Homey theme from the initial release through version 2.4.7. WordPress sites that install or continue to use Homey at or below that version are impacted.

With a CVSS score of 9.3, the overall severity is high. The EPSS score of < 1% indicates a low current probability of exploitation, though the vulnerability remains publicly known. It is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker delivering a malicious payload through the theme’s input handling (e.g., form submissions or URL parameters). Successful exploitation requires the attacker to have network access to the WordPress site and the ability to submit data to the vulnerable endpoint; additional privileges may further elevate the damage.