Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile

The core of this vulnerability lies in the plugin's account registration process. Homey, in vulnerable versions, permits newly registered users to self-assign roles, including those with significant administrative capabilities like Editor or Shop Manager. An attacker can exploit this by creating a new account and immediately assigning themselves a privileged role, effectively bypassing standard WordPress user access controls. This grants them the ability to modify content, manage users, and potentially compromise the entire WordPress site, depending on the permissions associated with the assigned role. The blast radius extends to any data accessible by the elevated user, including sensitive information stored within the WordPress database or accessible through plugins.

Websites utilizing the Homey plugin, particularly those with open user registration enabled, are at significant risk. Shared hosting environments where multiple WordPress sites share the same server resources are also vulnerable, as a compromise on one site could potentially lead to lateral movement and compromise other sites using the vulnerable plugin.

• wordpress / composer / npm:

grep -r 'wp_set_role\(\"$wp_user->roles\",' /var/www/html/wp-content/plugins/homey/*

• wordpress / composer / npm:

wp plugin list --status=active | grep homey

• wordpress / composer / npm:

wp plugin update homey --all

1. 2025-03-05Disclosure

   disclosure

1. Reserviert2024-12-05
2. Veröffentlicht2025-03-05
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-12281 is to immediately update the Homey plugin to a version that addresses the vulnerability. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider temporarily restricting user registration roles to prevent new accounts from being created with elevated privileges. WordPress administrators can also implement a Web Application Firewall (WAF) rule to block requests attempting to assign privileged roles during account creation. Regularly review user roles and permissions to identify and remove any unauthorized elevated accounts. After upgrading, confirm the fix by attempting to create a new user account and verifying that role assignment is restricted.

Aktive Installationen

10

Plugin-Bewertung