CVE-2024-11951

CRITICAL EXPLOITED

Homey Login Register <2.4.0 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2024-11951 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.

References (2)

Core 2

Core References

Various Sources

https://themeforest.net/item/homey-booking-wordpress-theme/23338013

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=cve

Scores

CVSS v3 9.8

EPSS 0.0040

EPSS Percentile 32.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2025-03-05

CWE

CWE-269

Status published

Products (1)

Fave Themes/Homey Login Register < 2.4.0

Published Mar 05, 2025

Tracked Since Feb 18, 2026