Homlisti Theme CVE-2026-66647

Exploitation requires the attacker to hold a valid WordPress Subscriber account on the target site - either obtained via open user registration or through credential compromise. The target site must have the Homlisti theme installed and active at version 3.1.2 or earlier. Attack complexity is low (AC:L) with no user interaction required once authenticated. Exploitation is limited by: the mandatory PR:L credential requirement (sites with closed user registration and no exposed subscriber credentials materially reduce risk), the Homlisti theme being installed and active (default WordPress installations without the theme are unaffected), and the scope being contained to the WordPress application (S:U, no lateral movement to other systems). Sites that restrict subscriber creation or use role-management plugins to block subscriber AJAX access reduce exposure without patching.

The CVSS 6.5 Medium score is supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N: the attack is network-accessible, requires no complexity, and demands only a subscriber-level account, which on WordPress sites with open registration is trivially obtainable. The high integrity impact (I:H) with no confidentiality or availability impact suggests unauthorized content or setting modification rather than data exfiltration or denial of service. EPSS probability data is not provided in available intelligence, limiting probabilistic exploitation assessment. KEV status is negative and no POC is publicly identified, indicating this is not currently under mass exploitation. The realistic priority is moderate: sites with open user registration running Homlisti ≤ 3.1.2 face meaningful risk of content manipulation by registered attackers, while sites with closed registration have a significantly reduced attack surface.

An attacker registers a free subscriber account on a WordPress site running Homlisti ≤ 3.1.2 where user registration is open, then authenticates and issues a crafted HTTP request directly to a theme AJAX handler or REST endpoint that lacks capability checks. Because no authorization gate enforces role restrictions, the subscriber-level request succeeds in modifying listings, settings, or content that should require Editor or Administrator privileges. No public exploit code has been identified at time of analysis.