CVE-2026-15980 MyHome CVE debrief

Who should care

WordPress administrators and users of the MyHome Core plugin and theme, especially those with administrator accounts or using the MyHome theme in legacy/WPBakery mode with frontend registration enabled.

Technical summary

The MyHome Core plugin for WordPress, up to and including version 4.4.5, is vulnerable to an authentication bypass. This is caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. An unauthenticated attacker can exploit this to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrator accounts. Exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled. The target account must not already have the myhome_agent_confirmed user meta set.

Defensive priority

High priority due to critical CVSS score and potential for full authentication bypass.

Recommended defensive actions

• Apply patches or updates for the MyHome Core plugin to version 4.4.6 or later.
• Review and adjust MyHome theme configurations to mitigate exploitation conditions.
• Monitor for suspicious authentication attempts and user account activities.
• Consider implementing additional security measures for WordPress installations, such as two-factor authentication.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from the NVD and CVE Program records confirms the vulnerability's existence and provides details on its nature. However, further information about affected versions beyond 4.4.5 and specific patches is limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.