What the vulnerability does
01Description
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
Explanation of Vulnerability in Simple Terms
02Summary
MyHome Core versions up to 4.4.5 contain an authentication bypass vulnerability that allows attackers to gain unauthorized access without valid credentials. The flaw stems from improper authentication logic that accepts alternate name formats to bypass login checks. An attacker can exploit this remotely over the network with no user interaction required, potentially gaining full control of the site.
What an attacker can do
03Attacker Capabilities
Bypass login authentication and gain unauthorized access to the site without valid credentials.
Potential impact on your site
04Site Impact
Attackers can access your site as if they were authenticated users, potentially reading, modifying, or deleting content and settings.
Conditions required to exploit
05Prerequisites
Network access only; no authentication, user interaction, or special configuration required.
Key dates
06Disclosure timeline
August 30, 2026
CVE published
August 31, 2026
Record updated
