The Homey WordPress theme suffers from an authorization bypass vulnerability (CWE-639) in the 'homey_delete_user_account' action. The vulnerability arises because the theme fails to validate a user-controlled key, enabling authenticated attackers with at least Subscriber privileges to delete accounts of other users. This insecure direct object reference can lead to unauthorized account deletions. The issue affects all versions up to 2.4.4. The CVSS 3.1 base score is 4.3 (medium), reflecting the limited impact on integrity and no impact on confidentiality or availability. No patch or remediation information is currently provided by the vendor.

An attacker with Subscriber-level or higher access can delete other users' accounts due to improper authorization checks. This compromises the integrity of user account data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious account deletion activity. Avoid granting Subscriber or higher privileges to untrusted users. Follow vendor updates for an official fix.