MyHome Core WordPress Plugin Authentication Bypass

Technical Analysis

CVE-2026-15980 stems from missing authorization checks in the send_link() AJAX handler combined with improper token validation in the activate() function of the MyHome Core plugin. Attackers can craft requests to generate a valid activation token for an unconfirmed user account and exchange it for a valid authentication cookie, effectively bypassing login credentials entirely. Exploitation is conditional: the MyHome theme must be in legacy/WPBakery mode with frontend registration and email confirmation enabled, and the target account must lack the myhome_agent_confirmed user meta flag. This is not a generic RCE but a logic flaw in account confirmation workflows, with a CVSS score of 9.8 reflecting the low complexity and high impact of full account takeover. Organizations running AI agents or automation tools that manage WordPress sites via admin credentials stored in agent memory, environment variables, or RAG-connected CMS plugins should treat any resulting admin-level compromise as a potential vector for credential and API key exposure used by those agents.

Affected Systems

MyHome Core plugin for WordPress, all versions up to and including 4.4.5; requires MyHome theme configured in legacy/WPBakery mode with frontend registration and email confirmation enabled

Indicators of Compromise

• No specific IOCs published; monitor for anomalous AJAX requests to send_link() and activate() endpoints, unexpected activation token generation, and unauthorized administrator account creation or login events

Remediation Steps

1. 1

   Update Plugin

   Upgrade MyHome Core plugin to a patched version beyond 4.4.5 as soon as it is released by the vendor.

2. 2

   Disable Vulnerable Configuration

   Disable legacy/WPBakery mode or frontend registration/email confirmation features until a patch is applied.

3. 3

   Audit User Accounts

   Review all user accounts, especially administrator-level accounts, for unauthorized changes or unconfirmed accounts that may have been exploited.

4. 4

   Monitor Logs

   Enable and review WordPress and web server logs for suspicious AJAX calls to send_link() and activate() functions.

5. 5

   Rotate Credentials

   If compromise is suspected, rotate all administrator credentials, API keys, and any secrets accessible from the WordPress environment, particularly those used by connected automation or AI agent integrations.