CVE-2025-49952
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
An authorization bypass through a user-controlled key vulnerability in the favethemes Houzez plugin allows exploitation of incorrectly configured access control security levels. This issue affects Houzez versions up to and including 4.2.5.
Risk Assessment
An attacker could gain access to functions or data they are not authorized for, potentially leading to unauthorized changes on the WordPress site.
Recommendation
Update the Houzez plugin to the latest version available from the vendor, which contains the fix for this vulnerability.
Other vulnerabilities in Houzez
See all- CVE-2026-96339High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.
- CVE-2025-9191Medium
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.1.6 via deserialization of untrusted input in saved-search-item.php. This allows authenticated attackers with Subscriber-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code.
- CVE-2025-49405Medium
The Houzez theme for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filenames in include/require statements. This affects versions before 4.1.4.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS