Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register

The impact of this vulnerability is severe. An attacker exploiting CVE-2024-11951 can bypass standard authentication mechanisms and gain full administrative control over the WordPress site. This grants them the ability to modify content, install malicious plugins, access sensitive data, and potentially compromise the entire system. The ease of exploitation—simply creating a new user account—significantly increases the risk, particularly for sites with limited security hardening or those relying solely on the plugin's default configuration. This vulnerability mirrors the impact of other privilege escalation flaws where attackers can gain unauthorized administrative access.

WordPress websites utilizing the Homey Login Register plugin, particularly those with limited security hardening or outdated plugin versions, are at significant risk. Shared hosting environments where plugin updates are not consistently managed are also particularly vulnerable. Sites relying on this plugin for user registration without robust role-based access controls face the highest exposure.

• wordpress / composer / npm:

grep -r 'wp_set_current_user' /var/www/html/wp-content/plugins/homey-login-register/

• wordpress / composer / npm:

wp plugin list --status=all | grep 'homey-login-register'

• wordpress / composer / npm:

wp plugin update homey-login-register --all

1. 2025-03-05Disclosure

   disclosure

1. Reserviert2024-11-27
2. Veröffentlicht2025-03-05
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-11951 is to upgrade the Homey Login Register plugin to a version that addresses the vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent new account creation. As a short-term workaround, restrict user registration to only trusted sources or implement a manual approval process for new accounts. Monitor WordPress logs for suspicious account creation attempts. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual user role assignments is recommended.