Insecure Direct Object Reference in Homey Theme for WordPress

CVE-2025-1327

What is CVE-2025-1327?

The Homey theme for WordPress has a vulnerability that allows authenticated attackers with Subscriber-level access or higher to delete other users' accounts. This occurs through the 'homey_delete_user_account' action due to insufficient validation of a user-controlled key, exposing users to potential account deletion by unauthorized personnel. Administrators should promptly update to a secure version to mitigate these risks.

References