CVE-2025-49375: 
WordPress vulnerability analysis and mitigation

CVE-2025-49375 is a Missing Authorization (Broken Access Control) vulnerability in the CozyThemes HomeLancer WordPress theme. It affects HomeLancer versions up to and including 1.0.1, allowing authenticated attackers with low privileges to exploit incorrectly configured access control security levels. The vulnerability was published on January 22, 2026, and was reported by Patchstack. The CNA (Patchstack) assigned a CVSS v3.1 base score of 5.4 (Medium), while CISA-ADP initially scored it 8.8 (High) before the Patchstack score superseded it (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the HomeLancer theme fails to perform adequate authorization checks before granting access to certain functionality. An authenticated attacker with low-level privileges can exploit this flaw over the network without any user interaction, by accessing restricted theme functions or endpoints that lack proper permission validation. The attack complexity is low, requiring only valid low-privilege credentials to trigger the misconfigured access control paths (Patchstack).

Successful exploitation could allow a low-privilege authenticated attacker to access restricted functionality and sensitive data within the WordPress installation running the HomeLancer theme. Potential consequences include unauthorized information disclosure (confidentiality breach), unauthorized modification of data (integrity violation), and disruption of site availability. The scope is limited to the affected WordPress instance, but depending on the exposed functionality, it could facilitate further privilege escalation or data exfiltration (Patchstack).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported at this time. The vulnerability requires a low-privilege authenticated account on the target WordPress site, which limits opportunistic exploitation but does not eliminate risk from insider threats or compromised accounts. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

Site administrators should update the HomeLancer theme to a version newer than 1.0.1 as soon as a patched release becomes available from CozyThemes. Until a patch is released, administrators should audit and restrict user permissions on the WordPress site, limiting low-privilege accounts' access to theme-related functionality. Consider temporarily deactivating the HomeLancer theme if the risk is deemed unacceptable and an alternative theme is available. Monitor WordPress access logs for unusual requests from low-privilege accounts targeting theme-specific endpoints (Patchstack).