CVE-2024-12281

CRITICAL EXPLOITED

Homey theme <2.4.2 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2024-12281 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or Shop Manager role.

References (2)

Core 2

Core References

Various Sources

https://themeforest.net/item/homey-booking-wordpress-theme/23338013

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/3b93c33c-4ab1-48a2-b84d-3cb38ccea829?source=cve

Scores

CVSS v3 9.8

EPSS 0.0040

EPSS Percentile 31.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2026-05-04

CWE

CWE-269

Status published

Products (1)

Fave Themes/Homey < 2.4.2

Published Mar 05, 2025

Tracked Since Feb 18, 2026