Authentication Bypass in Homey Theme for WordPress

CVE-2025-0749

Summary

The Homey theme for WordPress is susceptible to an authentication bypass that affects versions up to and including 2.4.3. This vulnerability arises from the 'verification_id' field being left empty, and the absence of a proper check on this field in the dashboard user profile section. Consequently, this can allow unauthenticated attackers to gain access to the first verified user's account, presenting serious security risks for site owners.

References