Unauthorized Data Modification in Homey Theme for WordPress

CVE-2025-1326

What is CVE-2025-1326?

The Homey theme for WordPress has a significant vulnerability stemming from a lack of capability checks in the homey_reservation_del() function. This flaw permits authenticated users with Subscriber-level permissions or higher to make unauthorized changes, including the deletion of arbitrary reservations and posts. Such unauthorized modifications can compromise the integrity of site data and disrupt the user experience.

References