CVE-2024-12281 is a critical vulnerability in the Homey WordPress theme that permits privilege escalation due to improper privilege management (CWE-269). Specifically, the theme allows new users registering accounts to set their own user role, including high-privilege roles like Administrator. This enables unauthenticated attackers to create accounts with elevated privileges, compromising confidentiality, integrity, and availability of the affected WordPress installation. The vulnerability affects all versions up to and including 2.4.2. No patch or official fix information is provided in the available data.

Successful exploitation allows unauthenticated attackers to gain administrative-level access to the WordPress site, leading to full control over site content, user data, and configuration. This can result in complete site compromise, data theft, defacement, or further malicious activity. The CVSS 3.1 base score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict user registration or disable it entirely to prevent exploitation. Monitoring for suspicious account creation and applying WordPress-level access controls may help mitigate risk temporarily. Avoid using affected versions of the Homey theme in production environments.