PT-2025-9823 · WordPress · Homey Login Register

Tonn · Published 2025-03-05 · Updated 2025-03-06 · CVE-2024-11951

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Homey Login Register plugin for WordPress versions up to and including 2.4.0

Description The issue allows unauthenticated attackers to gain elevated privileges by exploiting a flaw in the plugin's account registration process. This is possible because the plugin permits users to set their own role during registration, including the administrator role.

Recommendations For versions up to and including 2.4.0, update to a version that contains a fix for this issue to prevent privilege escalation.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-11951

Affected Products

Homey Login Register

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-11951 · Security Note
• https://themeforest.net/item/homey-booking-wordpress-theme/23338013 · Note
• https://twitter.com/VulmonFeeds/status/1897362158616187166 · Twitter Post
• https://twitter.com/cybercronai/status/1897362086826528897 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=cve · Note
• https://t.me/cvedetector/19629 · Telegram Post
• https://t.me/cvenotify/113549 · Telegram Post
• https://twitter.com/CveFindCom/status/1897248491488899116 · Twitter Post
• https://twitter.com/CVEnew/status/1897506925094355221 · Twitter Post