CVE-2026-15980

The MyHome Core plugin for WordPress, in all versions up to and including 4.4.5, contains an unauthenticated authentication bypass caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function (CWE-289). By driving the plugin's user-confirmation flow, an unauthenticated attacker can generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrator accounts, yielding full account takeover. Exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the targeted account must not already have the myhome_agent_confirmed user meta set. Any WordPress site running the affected plugin under those conditions is exposed, with administrator cookie theft leading to complete site compromise. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and EPSS estimates roughly a 0.5% probability of exploitation within 30 days.

What to do: Update the MyHome Core plugin to a patched release newer than 4.4.5 as soon as it is available. Until then, sites using the MyHome theme in legacy/WPBakery mode should disable frontend registration with confirmation email, or verify that all user accounts (especially administrators) already have the myhome_agent_confirmed user meta set, and review authentication logs for unexpected logins.