This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), affects Favethemes Homey versions up to 2.4.1. It allows an attacker to escalate privileges due to improper assignment of access rights within the application. The CVSS 3.1 score of 9.8 reflects that the vulnerability is remotely exploitable without authentication or user interaction and leads to full compromise of confidentiality, integrity, and availability. No patch or official remediation has been published by the vendor as of the latest update.

Successful exploitation of this vulnerability allows an attacker to escalate privileges within the affected Favethemes Homey application, potentially gaining unauthorized administrative control. This can lead to full compromise of the system's confidentiality, integrity, and availability. There are no reports of active exploitation in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is available, users should monitor vendor communications for updates. Until a patch is released, restrict access to the affected application to trusted users only and consider additional access controls to limit exposure.