{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0748", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-27T13:16:24.153Z", "datePublished": "2025-03-07T01:44:54.459Z", "dateUpdated": "2026-04-08T17:12:51.166Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:51.166Z"}, "affected": [{"vendor": "Fave Themes", "product": "Homey", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=cve"}, {"url": "https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-01-27T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-01-27T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-06T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-07T16:30:06.109867Z", "id": "CVE-2025-0748", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-07T16:30:28.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0748", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-07T16:30:06.109867Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-07T16:30:12.847Z"}}], "cna": {"title": "Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Fave Themes", "product": "Homey", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-27T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-01-27T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-06T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=cve"}, {"url": "https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog"}], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:51.166Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0748", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:12:51.166Z", "dateReserved": "2025-01-27T13:16:24.153Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-07T01:44:54.459Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El tema Homey para WordPress es vulnerable a Cross-Site Request Forgery en versiones hasta la 2.4.3 incluida. Esto se debe a la falta o la validaci\u00f3n incorrecta de nonce en la funci\u00f3n 'homey_verify_user_manually'. Esto hace posible que atacantes no autenticados actualicen la verificaci\u00f3n de un usuario a trav\u00e9s de una solicitud falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-0748", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-07T02:15:37.667", "references": [{"source": "security@wordfence.com", "url": "https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:04:42.106822+00:00", "value": {"mitigation_remediation": ["Upgrade the Homey theme to the latest version (>=2.4.4), which restores proper nonce validation.", "Install or enable a CSRF protection plugin to enforce strict nonce checks on all admin actions.", "Restrict administrator logins to trusted IP addresses or require two\u2011factor authentication to reduce the chance of malicious link execution."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Request Forgery"}, "threat_synthesis": {"affected_systems": "The Homey theme developed by Fave Themes is affected in all releases up to and including 2.4.3 when used on WordPress sites. No specific WordPress core versions are listed, so any installation of the theme in that range is vulnerable.", "description_and_impact": "The Homey theme for WordPress is vulnerable to CSRF because the homey_verify_user_manually function does not perform proper nonce validation. An unauthenticated attacker can send a forged request that an administrator executes, causing the system to update a user\u2019s verification status. This flaw allows the attacker to grant themselves or another user verified privileges without legitimate credentials. The weakness is recorded as CWE\u2011352.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 4.3, indicating moderate severity. The EPSS score is below 1\u202f%, showing low current exploitation likelihood, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft a forged request and persuade a site administrator to click a link, typically via phishing or a malicious embed. Because the flaw relies on missing nonce checks, no elevated access is required beyond the attacker\u2019s ability to initiate a request."}}}}, "created": "2026-04-21T22:15:45.897220+00:00", "updated": "2026-04-21T22:15:45.897236+00:00", "vendors": []}