CVE-2026-15980: MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhomeagentconfirmed user meta set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyHome Core (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.4.5 - Compensating control
Ensure the MyHome theme is not configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, to prevent the activation-token based authentication bypass and account takeover conditions described.
- Compensating control
For target accounts, ensure the myhome_agent_confirmed user meta is set (the described exploitation requires it to NOT already be set).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires the MyHome theme to use legacy/WPBakery mode, with frontend registration and confirmation email enabled. The affected MyHome Core plugin versions are 4.4.5 and earlier.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to target an unconfirmed account that does not already have the myhome_agent_confirmed user meta set.
What could an attacker gain through successful exploitation?
An attacker can generate an activation token for an eligible unconfirmed account and obtain a valid authentication cookie for that account. This can include administrator accounts if they meet the account-state requirement.