CVE-2025-0748

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3. This is due to missing or incorrect nonce validation on the 'homey_verify_user_manually' function. This makes it possible for unauthenticated attackers to update verify an user via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://favethemes.zendesk.com/hc/en-us/articles/4407721124884-Changelog
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a35a66c6-2a86-4f6e-b28e-d79e13489a49?source=cve

Published

Mar 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0742An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0743An Improper Access Control vulnerability has been found in E…4.3
• CVE-2025-0744an Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0745An Improper Access Control vulnerability has been found in E…6.5
• CVE-2025-0746A Reflected Cross-Site Scripting vulnerability has been foun…5.4
• CVE-2025-0747A Stored Cross-Site Scripting vulnerability has been found i…5.4
• CVE-2025-0749The Homey theme for WordPress is vulnerable to authenticatio…8.1
• CVE-2025-0750A vulnerability was found in CRI-O. A path traversal issue i…6.6
• CVE-2025-0751A vulnerability classified as critical has been found in Axi…6.5
• CVE-2025-0752A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. …7.1
• CVE-2025-0753A vulnerability classified as critical was found in Axiomati…6.5
• CVE-2025-0754The vulnerability was found in OpenShift Service Mesh 2.6.3 …4.3