Homey WordPress Theme Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Homey theme for WordPress, affecting versions through 2.4.3. The issue arises from inadequate nonce validation in the 'homey_verify_user_manually' function, allowing unauthenticated attackers to manipulate user verification by sending forged requests. Exploitation requires tricking a site administrator into clicking a link or performing a similar action.

Impact

Exploitation of this vulnerability could lead to unauthorized user verification, potentially allowing attackers to gain elevated privileges or access on the affected WordPress site.

Remediation

Users are advised to update the Homey WordPress theme to version 2.4.4 or a later patched version.