# CVE-2026-15980: MyHome Core authentication bypass in AJAX handler

Source: https://junglewise.ai/threats/cve-2026-15980-myhome-core-authentication-bypass-in-ajax-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15980 · Severity: critical · CVSS 9.8 · Published 2026-08-30

The MyHome Core WordPress plugin contains an authentication bypass vulnerability allowing unauthenticated attackers to generate activation tokens and obtain valid login credentials for any user account, including administrators. This bypasses the normal account confirmation process and could enable account takeover or unauthorized administrative access if the theme is configured with frontend registration and confirmation emails enabled.

## Quick answers

**Is CVE-2026-15980 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15980 being exploited in the wild.

**How severe is CVE-2026-15980?** Critical severity, with a CVSS score of 9.8, published 30 August 2026.

**Which products and versions are affected?** MyHome Core up to and including 4.4.5.

**Is there a fix for CVE-2026-15980?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15980 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15980?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the send_link() AJAX handler, which lacks proper authorization checks, and the activate() function, which performs improper token validation. An unauthenticated attacker can exploit missing validation in these functions to generate a valid activation token for an unconfirmed user account and subsequently obtain an authenticated session cookie. Exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set. An attacker can achieve full account takeover, including administrator access if targeted against an admin account.

## Affected products

- MyHome Core up to and including 4.4.5

## Timeline

- 2026-08-30: disclosed

## References

- [https://themeforest.net/item/myhome-real-estate-wordpress-theme/19508653](https://themeforest.net/item/myhome-real-estate-wordpress-theme/19508653)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e018-5901-4917-9847-35f07646e068?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/c458e018-5901-4917-9847-35f07646e068?source=cve)