CVE-2025-49375: WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability
Published Jan 22, 2026
·Updated
Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.
Affected Software
2 affected components
CozyThemes HomeLancer<=1.0.1
WordPress HomeLancer<=1.0.1
Event History
Jan 22, 2026
CVE Published
via MITRE·04:51 PM
Data Sourced
via MITRE·04:51 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Feb 23, 58291
Event
via MITRE·12:26 AM
Frequently Asked Questions
1
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker therefore needs an existing low-privilege account or equivalent access.
2
What is the likely impact if exploited?
The reported impact is limited confidentiality and integrity loss, with no availability impact. The issue is categorized as broken access control caused by incorrectly configured access-control security levels.
3
Which HomeLancer versions are affected?
HomeLancer versions through 1.0.1 are affected. The available data does not identify a fixed version.