Description

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-30T05:16:58.407Z",
  "pubdate": "2026-08-30T05:16:58.407Z",
  "executiveSummary": "The MyHome Core plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 4.4.5. The flaw originates from inadequate authorization checks within the send_link() AJAX handler combined with insufficient token validation logic in the activate() function. This allows unauthenticated remote attackers to forge activation tokens and hijack user sessions, including those with administrative privileges. The vulnerability poses a significant security risk, as it effectively nullifies standard WordPress authentication mechanisms. Successful exploitation is contingent upon specific theme configurations, namely the utilization of the MyHome theme in legacy/WPBakery mode with frontend registration and email confirmation enabled. Furthermore, the targeted account must lack the myhome_agent_confirmed user meta, which is the primary condition for the logic flow to remain susceptible to the bypass. If these conditions are met, an attacker can programmatically generate a valid authentication cookie for any targeted account, leading to full unauthorized access, potential data exfiltration, and complete site compromise.",
  "technicalDetails": "The vulnerability resides within the MyHome Core plugin, specifically affecting the authentication workflow responsible for user account verification. The root cause is a dual-layered failure in the security architecture: improper authorization in the AJAX action send_link() and flawed token validation in the activate() function.\nThe exploitation process begins by targeting the send_link() handler. Because this handler fails to implement robust access control checks, an attacker can manipulate it to initiate an activation flow for any existing user account. By supplying the target's credentials or identifiers, the attacker triggers the generation of an activation token, even if the user has not initiated the request.\nSubsequently, the attacker interacts with the activate() function. The vulnerability here stems from weak token verification logic that does not correctly validate the integrity or the context of the activation token provided. By exploiting this, an attacker can bypass the verification requirements that should strictly govern account confirmation.\nThe attack flow proceeds as follows: 1) The attacker identifies a target account that lacks the myhome_agent_confirmed user meta. 2) The attacker invokes the send_link() AJAX handler to create an activation token for the target user. 3) The attacker intercepts or reconstructs the token and submits it to the activate() function. 4) The server-side logic validates the malformed or unauthorized token as legitimate, erroneously setting the user status to confirmed. 5) The plugin responds by issuing a valid authentication cookie for the target user account, effectively logging the attacker into the application as that user.\nThe impact is severe; if an administrator account is targeted, the attacker achieves total administrative control over the WordPress installation. This facilitates the execution of arbitrary code via plugin or theme uploads, modification of site content, and potential escalation of privileges within the hosting environment. The reliance on legacy/WPBakery mode and specific registration settings narrows the immediate attack surface, but for sites matching this configuration, the security posture is effectively compromised due to the lack of nonce validation or proper server-side session binding in the affected functions.\nAffected versions include all iterations up to 4.4.5. The vulnerability is externally exploitable over the network without requiring any prior authentication, making it a critical threat to the integrity of the WordPress user management system."
}