CVE-2025-1326

Name of the Vulnerable Software and Affected Versions Homey theme for WordPress versions prior to 2.4.5

Description The issue allows authenticated attackers with Subscriber-level access and above to delete arbitrary reservations and posts due to a missing capability check on the homey reservation del() function.

Recommendations For versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the homey reservation del() function to prevent unauthorized data modification.