MyHome Core WordPress Plugin: Auth Bypass Enables Admin Takeover (CVE-2026-15980)

Executive Summary

CVE-2026-15980 affects MyHome Core, a plugin by TangibleWP that underpins the MyHome real-estate WordPress theme, in all versions through 4.4.5. The flaw is an authentication bypass by alternate name (CWE-289) caused by missing authorization in the plugin's send_link() AJAX handler and improper token validation in its activate() function.

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated attacker can generate a valid activation token for an unconfirmed user account and exchange it for an authentication cookie for that account — including administrator accounts that have not yet completed email confirmation. The vulnerability was assigned by Wordfence, reserved July 16, 2026, and published August 30, 2026.

Vulnerability Overview

Affected Versions

Technical Details

MyHome Core exposes a send_link() AJAX handler that is meant to email an activation link to a newly registered account, and an activate() function that redeems the token embedded in that link for a logged-in session. The send_link() handler is missing an authorization check, so any unauthenticated caller can trigger it for an arbitrary account. Because activate() then fails to properly validate that the redeemed token actually belongs to the requesting session, an attacker can walk through the same flow directly and obtain a valid authentication cookie for the targeted account.

Exploitation Requirements

Exploitation is conditional, not universal — a site is only exposed when all of the following hold:

• The MyHome theme is configured in legacy/WPBakery mode
• Frontend registration is enabled
• Confirmation email is enabled for new accounts
• The target account does not yet have the myhome_agent_confirmed user-meta flag set

Sites running MyHome in its newer (non-legacy) mode, or with frontend registration disabled, are not exploitable through this path.

Attack Vector

1. Attacker identifies a target running MyHome Core ≤ 4.4.5 in legacy/WPBakery
   mode with frontend registration + email confirmation enabled
2. Attacker calls the send_link() AJAX handler for an unconfirmed account
   (no authorization check blocks the request)
3. Attacker exploits the activate() function's improper token validation
   to redeem the resulting token themselves
4. Attacker receives a valid authentication cookie for that account
5. If the targeted account is an unconfirmed administrator, the attacker
   gains full administrative access to the site

Impact of Successful Exploitation

Immediate Remediation

Step 1: Check for a Patched Release

A fixed version had not been published in the public CVE record at the time of writing. Site owners should check the plugin's WordPress.org page and changelog directly, and update immediately once a patch ships.

# From wp-cli, check the installed version and available update
wp plugin get myhome-core --field=version
wp plugin update myhome-core --dry-run

Step 2: Mitigate Pending a Patch

If MyHome is running in legacy/WPBakery mode, consider temporarily disabling frontend registration or switching to the non-legacy mode until a fix is available — this removes the exploitation path entirely.

Step 3: Audit Existing Accounts

Review WordPress users for administrator or elevated accounts that are still in an unconfirmed state (missing myhome_agent_confirmed meta), and confirm or remove them.

-- Identify users lacking the myhome_agent_confirmed meta flag
SELECT u.ID, u.user_login, u.user_email
FROM wp_users u
LEFT JOIN wp_usermeta m ON u.ID = m.user_id AND m.meta_key = 'myhome_agent_confirmed'
WHERE m.meta_id IS NULL;

Step 4: Review Access Logs

Look for repeated or automated calls to admin-ajax.php with action=send_link or action=activate from unfamiliar IP addresses.

Detection Indicators

Post-Remediation Steps

1. Apply the vendor patch as soon as it is published for MyHome Core.
2. Force-confirm or remove any lingering unconfirmed administrator accounts.
3. Rotate credentials for any account suspected of being accessed through this flaw.
4. Restrict legacy/WPBakery mode and frontend self-registration to only the sites that genuinely require them.
5. Monitor admin-ajax.php traffic for this plugin's action handlers going forward.

References

• OffSeq Threat Radar — CVE-2026-15980: Authentication Bypass by Alternate Name in TangibleWP MyHome Core
• NVD — CVE-2026-15980