CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary reservations and posts.
Explanation of Vulnerability in Simple Terms
Homey theme versions up to 2.4.4 lack proper authorization checks, allowing authenticated users with low privileges to modify content they should not have access to. The vulnerability requires a valid user account but no special interaction. Site administrators should update to a version newer than 2.4.4 to prevent unauthorized content changes.
What an attacker can do
Modify content or settings they lack permission to change.
Potential impact on your site
Authenticated users can alter site content or configuration beyond their assigned role permissions.
Conditions required to exploit
Valid user account with low privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
