What is the CVSS score of CVE-2025-67965?

CVE-2025-67965 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Homey Core CVE-2025-67965

Q: Which versions of Homey Core are affected by CVE-2025-67965?

Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability.

MEDIUM

Missing Authorization (CWE-862)

2025-12-16 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Remote unauthenticated attack with low complexity; only availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:08 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

AnalysisAI

Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.

Technical ContextAI

Homey Core is a WordPress plugin (slug: homey-core) that extends the functionality of the Homey theme, often used for real estate or property listing websites. The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify that a user has sufficient privileges before allowing access to a function or resource. This class of flaw is common in WordPress plugins where REST API routes, AJAX actions, or admin pages lack capability checks, enabling any visitor (including unauthenticated users) to trigger actions that should be restricted. The affected product is identified via the Patchstack advisory, and while no specific CPE is provided by NVD, the WordPress plugin ecosystem context indicates that the missing authorization likely resides in publicly reachable endpoints.

Affected ProductsAI

Homey Core plugin versions from n/a through 2.4.3 are affected. The vendor's advisory (Patchstack) details the vulnerability at https://patchstack.com/database/Wordpress/Plugin/homey-core/vulnerability/wordpress-homey-core-plugin-2-4-3-broken-access-control-vulnerability?_s_id=cve. No CPE string is available from NVD at this time.

RemediationAI

Update the Homey Core plugin to a version later than 2.4.3, as a vendor‑released patch is available. If an update cannot be applied immediately, consider temporarily disabling the plugin to eliminate the exposure, though this may break theme‑dependent functionality. No workarounds are documented; refer to the Patchstack advisory for guidance on the patched version.