CVE-2025-0748

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-07498.1The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verificatiCVE-2025-07506.6A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow CVE-2025-07516.5A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of CVE-2025-07527.1A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and reCVE-2025-07536.5A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStCVE-2025-07544.3The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by EnvCVE-2025-07557.5The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that coulCVE-2025-07569.1Overview   The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before CVE-2025-07574.4Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is usCVE-2025-07586.1Overview  The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified byCVE-2025-07593.3IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronizationCVE-2025-07602.7A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encrypt