PT-2025-10028 · WordPress · Homey

István Márton · Publicado 2025-03-07 · Atualizado 2025-03-12 · CVE-2025-0749

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Homey theme for WordPress versions up to and including 2.4.3

Description The issue allows for authentication bypass due to the verification id value being set to empty and a missing not empty check in the dashboard user profile page. This enables unauthenticated attackers to log in to the first verified user.

Recommendations For versions up to and including 2.4.3, update to a version that includes the necessary checks to prevent authentication bypass, specifically ensuring that the verification id value is properly validated.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2025-0749

Produtos afetados

Homey

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-0749 · Nota de Segurança
• https://t.me/latest_high_impact_cve/1927 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1897878633491886193 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1898078869351006319 · Publicação no Twitter
• https://twitter.com/cracbot/status/1899777456133091713 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/05f87510-28c3-4ad1-b2be-2408a199cf68?source=cve · Nota
• https://t.me/cvenotify/113774 · Publicação no Telegram
• https://t.me/cvedetector/19774 · Publicação no Telegram
• https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog · Nota