CVE-2026-15980Disclosure

⚠️ Vulnerabilidad en complemento de WordPress ❗ CVE-2026-15980 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-complemento-de-wordpress-11/ https://t.co/8IHCC9EL2y

WordPress users: MyHome Core plugin has CVSS 9.8 auth bypass in versions <=4.4.5. Review and update if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-15980 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/zULOGQbbim

🚨 CRITICAL AUTH BYPASS — WORDPRESS FLAW CAN LET AN UNAUTHENTICATED ATTACKER TAKE OVER AN ADMIN ACCOUNT No password theft is required. CyberSignal Priority: 🔴 VERY HIGH 📅 August 30, 2026 🆔 CVE-2026-15980 📊 CVSS 9.8 CRITICAL 📦 MyHome Core · WordPress 🏷️ Authentication Bypass · Account Takeover ### 🔎 What happened A critical authentication vulnerability has been disclosed in the MyHome Core WordPress plugin. The weakness exists in two parts of the account-activation flow: `send_link()` AJAX handler * `activate()` function The first lacks proper authorization checks, while the second improperly validates activation tokens. Together, those weaknesses can allow an unauthenticated attacker to create an activation token for another unconfirmed account. The attacker can then obtain a valid WordPress authentication cookie for that account. That account could be an administrator. ### ⚔️ Attack chain Identify eligible unconfirmed account ↓ Unauthenticated request to activation workflow ↓ Abuse `send_link()` AJAX handler ↓ Generate activation token ↓ Pass token into vulnerable `activate()` logic ↓ Receive valid authentication cookie ↓ Impersonate victim account ↓ Potential WordPress admin takeover No existing authenticated session is required. No victim interaction is required. ### 🎯 What is affected MyHome Core: ≤ 4.4.5 Successful exploitation requires a specific configuration: • MyHome operating in legacy / WPBakery mode • frontend registration enabled • confirmation emails enabled • target account remains unconfirmed • target does not already have the required `myhome_agent_confirmed` state set So this is NOT automatically exploitable against every MyHome installation. ### 🧠 Why this matters Authentication systems are supposed to answer one fundamental question: “Are you really this user?” Here, the activation mechanism itself can become the path around that question. And because the vulnerable workflow can apply to privileged accounts, exploitation could transform: one unauthenticated HTTP request path into a legitimate authenticated WordPress session. From there, an administrator account may expose: plugins ↓ themes ↓ users ↓ content ↓ site configuration ↓ potential server-side execution paths ### ⚠️ Important caveat There is currently no verified evidence in the disclosure showing widespread in-the-wild exploitation. The attack also depends on the specific MyHome configuration and account state described above. So: CVSS 9.8 ≠ confirmed active exploitation. But the technical impact is still severe. ### 🛡️ Defender action Administrators using MyHome should immediately: • identify the installed MyHome Core version • review the vendor/Wordfence remediation guidance • disable frontend registration temporarily if remediation cannot be applied • audit unconfirmed privileged accounts • inspect unusual account-activation requests • review recent WordPress authentication cookies/sessions • monitor requests targeting the activation AJAX workflow • invalidate suspicious administrative sessions CyberSignal Insight: **Account activation is part of your authentication boundary. If activation tokens can be forged, the password may never need to be stolen.** Sources: Wordfence · CVE · NVD · PT Security