An unauthenticated attacker can forge an account activation token in TangibleWP's MyHome Core plugin (≤ 4.4.5) and obtain a valid authentication cookie for any unconfirmed user; including administrators.
What Is It
CVE-2026-15980 is an authentication bypass (CWE-289, Authentication Bypass by Alternate Name) in the MyHome Core plugin for WordPress. Two defects combine: the send_link() AJAX handler is missing an authorization check, and the activate() function performs improper token validation. Together these allow an unauthenticated attacker to generate an activation token for an unconfirmed user account and then exchange it for a valid authentication cookie for that account.
Wordfence rates the issue CVSS 3.1 base score 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges and no user interaction required, with high confidentiality, integrity, and availability impact.
Why It Matters
The attack path ends in account takeover, and the NVD description explicitly notes the targetable set includes administrators. An attacker who lands an admin session on a WordPress site inherits full control of the site's content, users, and plugin/theme code. No credentials, no phishing, and no victim interaction are needed; the maximum exploitability sub-score of 3.9 reflects exactly that.
The CVE record was published 2026-08-30 and is currently in Received status at NVD. CVE-2026-15980 is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor: TangibleWP
- Product: MyHome Core plugin for WordPress
- Affected versions: all versions up to and including 4.4.5
Exploitation is conditional. Per the advisory, the site must have the MyHome theme configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set. Sites outside that configuration are not exploitable via this path.
Patch Status
Neither the NVD record nor the Wordfence advisory identifies a fixed version, and Wordfence lists no patched release for the plugin. Operators running MyHome Core 4.4.5 or earlier should treat every version as affected until the vendor publishes a patched release, and should consider disabling frontend registration or legacy/WPBakery mode to remove the exploit precondition in the interim.
Sources
- NVD, CVE-2026-15980: https://nvd.nist.gov/vuln/detail/CVE-2026-15980
- Wordfence Threat Intelligence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e018-5901-4917-9847-35f07646e068?source=cve
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- ThemeForest; MyHome Real Estate WordPress Theme: https://themeforest.net/item/myhome-real-estate-wordpress-theme/19508653