CVE-2025-1326

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1326", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-14T23:46:22.758Z", "datePublished": "2025-05-02T03:21:20.744Z", "dateUpdated": "2026-04-08T17:19:44.523Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:44.523Z"}, "affected": [{"vendor": "Fave Themes", "product": "Homey", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts."}], "title": "Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f?source=cve"}, {"url": "https://themeforest.net/item/homey-booking-wordpress-theme/23338013"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ayoub Nouri"}], "timeline": [{"time": "2025-05-01T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-02T16:08:58.211437Z", "id": "CVE-2025-1326", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-02T16:18:28.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1326", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-02T16:08:58.211437Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-02T16:18:25.813Z"}}], "cna": {"title": "Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Ayoub Nouri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Fave Themes", "product": "Homey", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-01T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f?source=cve"}, {"url": "https://themeforest.net/item/homey-booking-wordpress-theme/23338013"}], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:44.523Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1326", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:44.523Z", "dateReserved": "2025-02-14T23:46:22.758Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-02T03:21:20.744Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Homey", "vendor": "Fave Themes", "versions": [{"lessThanOrEqual": "2.4.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:favethemes:homey:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "9407FACC-67ED-4842-B1C4-228A371821D5", "versionEndExcluding": "2.4.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts."}, {"lang": "es", "value": "El tema Homey para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a la falta de una comprobaci\u00f3n de capacidad en la funci\u00f3n homey_reservation_del() en todas las versiones hasta la 2.4.4 incluida. Esto permite que atacantes autenticados, con acceso de suscriptor o superior, eliminen reservas y publicaciones arbitrarias."}], "id": "CVE-2025-1326", "lastModified": "2026-06-17T08:38:55.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1326", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-02T16:08:58.211437Z", "version": "2.0.3"}}]}, "published": "2025-05-02T04:15:46.530", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://themeforest.net/item/homey-booking-wordpress-theme/23338013"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ef3ae7-b3c0-4f54-a95d-9f8cf9497d8f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:02:49.280124+00:00", "value": {"mitigation_remediation": ["Upgrade the Homey theme to version 2.4.5 or later, which includes the missing capability check.", "If an upgrade is not immediately possible, remove or restrict the delete_post and delete_others_post capabilities from the Subscriber role to prevent reservation or post deletion.", "Monitor site logs for unexpected reservation or post deletions and audit user activity following the update."], "summary": {"action": "Update Theme", "impact": "Data Deletion by Authenticated Users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Homey booking and rentals WordPress theme from Fave Themes, versions 2.4.4 and earlier. Any WordPress site installing these theme versions is susceptible.", "description_and_impact": "The Homey WordPress theme is vulnerable because its homey_reservation_del() function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to delete any reservation or post. This enables attackers to erase booking data, potentially causing loss of revenue, disrupting service, and eroding user trust. The flaw is a classic example of missing authorization, identified as CWE-862.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity, and the EPSS score is below 1%, suggesting low likelihood of exploitation. Attacks require a valid authenticated account with Subscriber-level permissions or higher, and exploitability hinges on the theme\u2019s deletion function. The vulnerability is not listed in CISA\u2019s KEV catalog, implying no known widespread exploitation at the time."}}}}, "created": "2026-04-20T23:15:06.301596+00:00", "updated": "2026-04-20T23:15:06.301607+00:00", "vendors": []}