CVE-2026-15980: CWE-289 Authentication Bypass by Alternate Name in TangibleWP MyHome Core

CVE-2026-15980 is an authentication bypass vulnerability in the MyHome Core plugin for WordPress affecting all versions up to and including 4.4.5. The vulnerability arises from missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. An attacker can generate an activation token for an unconfirmed user and obtain a valid authentication cookie, effectively bypassing authentication controls. Successful exploitation requires the MyHome theme to be in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target user account must not have the myhome_agent_confirmed user meta set.

An unauthenticated attacker can bypass authentication and gain access to user accounts, including administrator accounts, by generating valid activation tokens and authentication cookies. This leads to full compromise of affected WordPress sites using the vulnerable plugin under the specified configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling frontend registration and confirmation email features or avoid using the MyHome theme in legacy/WPBakery mode to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.