critical advisory August 30, 2026

Authentication Bypass in MyHome Core Plugin for WordPress

The MyHome Core plugin for WordPress is vulnerable to authentication bypass via insecure AJAX handlers, allowing unauthenticated attackers to hijack arbitrary user accounts.

The MyHome Core plugin for WordPress contains a critical authentication bypass vulnerability (CVE-2026-15980) affecting all versions up to and including 4.4.5. The vulnerability stems from two primary flaws: missing authorization checks in the send_link() AJAX handler and improper token validation within the activate() function.

Attackers can exploit these flaws to generate a valid activation token for an unconfirmed user account and subsequently obtain a valid authentication cookie. This allows an unauthenticated actor to hijack any user account, including those with administrator privileges. The exploitation requires specific configuration: the MyHome theme must be operating in legacy or WPBakery mode with frontend registration and confirmation email functionality enabled. Additionally, the target user account must not have the 'myhome_agent_confirmed' metadata flag set. Because this vulnerability allows for complete site takeover, immediate remediation is required for all affected WordPress instances.

Impact

Successful exploitation results in full account takeover, including administrative access. This grants attackers the ability to modify site content, inject malicious scripts, install additional backdoors, or exfiltrate sensitive data from the WordPress database. The scope includes any WordPress environment using the MyHome theme configured for frontend registration.

Recommendation

Update the MyHome Core plugin to the latest available version beyond 4.4.5 immediately to resolve CVE-2026-15980.
Disable frontend registration or the confirmation email feature in the MyHome theme settings if updating is not immediately feasible.
Audit user accounts for unauthorized sessions or unexpected changes in user metadata, specifically checking for the presence of the 'myhome_agent_confirmed' key.
Implement strict access controls for site administration and monitor web server logs for suspicious POST requests targeting /wp-admin/admin-ajax.php related to the MyHome theme's AJAX handlers.

Immediate actions

Upgrade MyHome Core plugin to version > 4.4.5

IT Operations 24h

Threat Hunt

Look for POST requests to /wp-admin/admin-ajax.php with action=activate or action=send_link

T1550 high high confidence hunt now

Data: Web server access logs

Mitigations

Disable frontend registration in MyHome theme settings

immediate IT Operations

CVE-2026-15980

Detection coverage 1

Detects CVE-2026-15980 Exploitation - Suspicious AJAX Activation Request

high

Detects exploitation attempts against the MyHome Core plugin by identifying POST requests to admin-ajax.php that may be invoking the vulnerable activate() or send_link() functions.

sigma tactics: initial_access techniques: T1550 sources: webserver

Detection queries are available on the platform. Get full rules →