The Homey WordPress theme contains a missing authorization vulnerability (CWE-862) in the homey_reservation_del() function, which fails to verify user capabilities before allowing deletion of reservations and posts. This flaw permits authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized deletions. The issue affects all versions up to 2.4.4. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts integrity but not confidentiality or availability.

An attacker with Subscriber-level access or higher can delete arbitrary reservations and posts within the Homey theme environment. This results in unauthorized modification of data, specifically integrity loss, but does not affect confidentiality or availability. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and consider disabling or limiting access to the vulnerable functionality if possible.