CVE-2025-49375
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cozythemes | homelancer | to 1.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the WordPress HomeLancer Theme (up to version 1.0.1) caused by missing authorization, authentication, or nonce token checks in certain functions. It allows users with subscriber-level privileges to perform actions that should be restricted to higher-privileged roles. [1]
How can this vulnerability impact me? :
The impact is considered low severity with a CVSS score of 5.4. Although it allows unprivileged users to perform restricted actions, it is unlikely to be leveraged for highly impactful attacks. However, it could lead to unauthorized actions within the affected WordPress theme. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if the HomeLancer WordPress theme version is 1.0.1 or earlier, as these versions contain the vulnerability. Since the issue is due to missing authorization checks allowing subscriber-level users to perform privileged actions, you can test by attempting to perform administrative actions while logged in as a subscriber. There are no specific network commands provided. Checking the theme version can be done via WordPress admin dashboard or by inspecting the theme files. No explicit commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the HomeLancer WordPress theme to version 1.0.2 or later, where the vulnerability is fixed. Additionally, restricting subscriber-level privileges and monitoring for unauthorized actions can help reduce risk until the update is applied. [1]