Myhome Core
Monthly
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.