Attackers can exploit these flaws to generate a valid activation token for an unconfirmed user account and subsequently obtain a valid authentication cookie. This allows an unauthenticated actor to hijack any user account, including those with administrator privileges. The exploitation requires specific configuration: the MyHome theme must be operating in legacy or WPBakery mode with frontend registration and confirmation email functionality enabled. Additionally, the target user account must not have the 'myhome_agent_confirmed' metadata flag set. Because this vulnerability allows for complete site takeover, immediate remediation is required for all affected WordPress instances.

Impact

Successful exploitation results in full account takeover, including administrative access. This grants attackers the ability to modify site content, inject malicious scripts, install additional backdoors, or exfiltrate sensitive data from the WordPress database. The scope includes any WordPress environment using the MyHome theme configured for frontend registration.

Recommendation

• Update the MyHome Core plugin to the latest available version beyond 4.4.5 immediately to resolve CVE-2026-15980.
• Disable frontend registration or the confirmation email feature in the MyHome theme settings if updating is not immediately feasible.
• Audit user accounts for unauthorized sessions or unexpected changes in user metadata, specifically checking for the presence of the 'myhome_agent_confirmed' key.
• Implement strict access controls for site administration and monitor web server logs for suspicious POST requests targeting /wp-admin/admin-ajax.php related to the MyHome theme's AJAX handlers.