CVE-2025-0749— Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
Quick assessment
Affected
Fave Themes Homey
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Homey 2.4.3及之前版本存在安全漏洞，该漏洞源于verification_id值设置为空且缺少非空检查，可能导致未认证攻击者登录第一个已验证用户。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0749
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
Source: CVE Program / CVE List V5
Vulnerability Description
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Homey 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Homey 2.4.3及之前版本存在安全漏洞，该漏洞源于verification_id值设置为空且缺少非空检查，可能导致未认证攻击者登录第一个已验证用户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Fave Themes | Homey | * ~ 2.4.3 | - |
|
II. Public POCs for CVE-2025-0749
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0749
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-0749 (1)
Vendor Pages for CVE-2025-0749 (1)
IV. Related Vulnerabilities
Same product: Homey
-
CVE-2025-31037
WordPress Homey theme <= 2.4.5 - Reflected Cross Site Script -
CVE-2025-52834
WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability -
CVE-2025-1326
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missi -
CVE-2025-1327
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insec -
CVE-2024-51800
WordPress Homey theme <= 2.4.1 - Privilege Escalation vulner
Same vendor: Fave Themes
-
CVE-2025-1326
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missi -
CVE-2025-1327
Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insec -
CVE-2025-0748
Homey <= 2.4.3 - Cross-Site Request Forgery to User Verifica -
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in hom -
CVE-2024-11951
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Es
Same weakness: CWE-288
-
CVE-2026-65641
SMB：未认证攻击者迫使服务账户认证 -
CVE-2026-3035
Authentication Bypass Using an Alternate Path or Channel in -
CVE-2026-58092
Unauthorized credential switching -
CVE-2026-16639
Internationalization Single Sign-On - Critical - Access bypa -
CVE-2026-63587
SMS Password Authorization Bypass via Failed Attempt Counter
V. Comments for CVE-2025-0749
No comments yet