CVE-2025-67965: 
WordPress vulnerability analysis and mitigation

CVE-2025-67965 is a Missing Authorization (Broken Access Control) vulnerability in the favethemes Homey Core WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects Homey Core versions up to and including 2.4.3, with version 2.4.4 being the patched release. The vulnerability was reported on November 10, 2025, and published by Patchstack on December 10–16, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more functions within the Homey Core plugin fail to perform adequate authorization checks before executing privileged actions. This allows unauthenticated network-based attackers to invoke functionality that should be restricted to higher-privileged users, consistent with OWASP Top 10 category A1: Broken Access Control. No authentication, user interaction, or elevated privileges are required to trigger the flaw, and attack complexity is low. Specific vulnerable endpoints or function names have not been publicly disclosed in available sources (Patchstack).

Successful exploitation results in a low availability impact — the CVSS vector indicates no confidentiality or integrity impact, suggesting the primary risk is limited disruption to affected functionality rather than data exposure or unauthorized data modification. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity. The practical impact may vary depending on which specific privileged actions are accessible without authorization (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though it notes the vulnerability class is associated with mass-exploit campaigns (Patchstack).

The vendor has released Homey Core version 2.4.4, which resolves this vulnerability. Site administrators should update the Homey Core plugin to version 2.4.4 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).