CVE-2026-15980

The record

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.

Affected packages

Related vulnerabilities

• CVE-2026-32639 Winter CMS is a content management system built on the Laravel PHP framework. CWE-289
• CVE-2026-15985 The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to… CWE-289
• CVE-2026-9701 The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in… CWE-289
• CVE-2026-55075 Coder allows organizations to provision remote development environments via Terraform. CWE-289
• CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially… CWE-289
• CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. CWE-289
• CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience)… CWE-289
• CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. CWE-289