{"id":"CVE-2026-15980","aliases":["EUVD-2026-68149","GHSA-6hcx-8gm4-gx5h"],"status":"published","title":"MyHome Core \u003c= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token","description":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00683,"percentile":0.52974,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-289"],"published":"2026-08-30T04:25:48Z","modified":"2026-08-31T20:17:03Z","products":[{"vendor":"tangiblewp","product":"myhome core"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e018-5901-4917-9847-35f07646e068?source=cve"},{"url":"https://themeforest.net/item/myhome-real-estate-wordpress-theme/19508653"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15980"},{"url":"https://github.com/advisories/GHSA-6hcx-8gm4-gx5h"}],"sources":{"cve":[{"id":"CVE-2026-15980","title":"MyHome Core \u003c= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token","description":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.","status":"published","published":"2026-08-30T04:25:48.138Z","modified":"2026-08-31T19:52:37.077Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-68149","description":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.","status":"published","published":"2026-08-30T04:25:48Z","modified":"2026-08-31T19:52:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:19.818565Z"}],"ghsa":[{"id":"GHSA-6hcx-8gm4-gx5h","title":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to...","description":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.","status":"published","published":"2026-08-30T06:30:21Z","modified":"2026-08-30T06:30:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T15:11:10.168906Z"}],"nvd":[{"id":"CVE-2026-15980","description":"The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.","status":"published","published":"2026-08-30T05:16:58.407Z","modified":"2026-08-31T20:17:03.38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-289"],"updated_at":"2026-11-02T14:12:42.691315Z"}]}}