MyHome Core
MyHome Core provides core functionality for the MyHome real estate WordPress theme.
MyHome Core (myhome-core) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 30, 2026; the highest published CVSS base score is 9.8.
myhome-coreCVE-2026-15980: MyHome Core permits unauthenticated takeover of unconfirmed accounts
MyHome Core through 4.4.5 omits authorization from the send_link() AJAX handler and improperly validates activation tokens in activate(). An unauthenticated attacker can generate an activation token for an unconfirmed account and obtain a valid authentication cookie for it, including an Administrator account. Exploitation requires the MyHome theme in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user metadata set.
| Safe version |
|
||
|---|---|---|---|
| Aug 30, 2026 |
CVE-2026-15980
MyHome Core permits unauthenticated takeover of unconfirmed accounts
MyHome Core through 4.4.5 omits authorization from the send_link() AJAX handler and improperly validates activation tokens in activate(). An unauthenticated attacker can generate an activation token for an unconfirmed account and obtain a valid authentication cookie for it, including an Administrator account. Exploitation requires the MyHome theme in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user metadata set.
|
See mitigation notes |
CVE9.8
|
| Jan 22, 2026 |
CVE-2025-67955
MyHome Core: Filesystem traversal
MyHome Core is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
|