PT-2025-10028 · WordPress · Homey

István Márton · Published 2025-03-07 · Updated 2025-03-12 · CVE-2025-0749

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Homey theme for WordPress versions up to and including 2.4.3

Description The issue allows for authentication bypass due to the verification id value being set to empty and a missing not empty check in the dashboard user profile page. This enables unauthenticated attackers to log in to the first verified user.

Recommendations For versions up to and including 2.4.3, update to a version that includes the necessary checks to prevent authentication bypass, specifically ensuring that the verification id value is properly validated.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-0749

Affected Products

Homey

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-0749 · Security Note
• https://t.me/latest_high_impact_cve/1927 · Telegram Post
• https://twitter.com/CVEnew/status/1897878633491886193 · Twitter Post
• https://twitter.com/cybercronai/status/1898078869351006319 · Twitter Post
• https://twitter.com/cracbot/status/1899777456133091713 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/05f87510-28c3-4ad1-b2be-2408a199cf68?source=cve · Note
• https://t.me/cvenotify/113774 · Telegram Post
• https://t.me/cvedetector/19774 · Telegram Post
• https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog · Note