MyHome Core CVE-2026-15980

Exploitation requires the MyHome theme to be running in legacy/WPBakery mode with BOTH frontend registration AND confirmation email enabled, and the target account must NOT already have the myhome_agent_confirmed user meta set (i.e., an unconfirmed account). Given these are met, no authentication and no user interaction are needed (PR:N/UI:N): the unauthenticated attacker calls the send_link() AJAX handler to generate an activation token and passes it to activate(). Limiting factors: sites in the newer/default (non-legacy) mode, sites with frontend registration or confirmation email disabled, and already-confirmed target accounts are not exploitable via this path - these non-default-dependent preconditions meaningfully narrow the exposed population despite the network vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, score 9.8) describes remote, unauthenticated, no-interaction admin compromise - the maximum-severity profile for a WordPress plugin. However, the raw score understates the environmental preconditions: exploitation only works when the theme runs in legacy/WPBakery mode with frontend registration and confirmation email enabled, AND the target account has not yet had its myhome_agent_confirmed meta set. This makes real-world reachability narrower than a blanket 9.8 implies, so it behaves more like a high-confidence conditional takeover than a universally sprayable bug. No EPSS score, KEV listing, or POC was supplied, so exploitation likelihood cannot be quantified from the input; the absence of KEV means no confirmed active exploitation, but administrator-takeover bugs in commercial themes are attractive targets, so any operator running MyHome in the affected mode should treat this as urgent and patch immediately rather than waiting for exploitation signals.

An attacker browses a MyHome site running in legacy/WPBakery mode, identifies or registers an unconfirmed account (including targeting a known admin account that has never completed confirmation), and calls the unauthenticated send_link() AJAX handler to generate an activation token. They then submit the predictable/poorly-validated token to activate(), and the site returns a valid WordPress authentication cookie for that account, granting full administrator access. No public POC was provided, but the network-based, low-complexity, no-interaction vector makes weaponization straightforward once the flow is understood.