MyHome Core WordPress Plugin Vulnerable to Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- myhome core plugin (wordpress)
- Patched version
- Not yet available
The MyHome Core plugin for WordPress is reportedly vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This vulnerability could allow unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.
What happened
An early warning has been issued for a critical vulnerability in the MyHome Core plugin for WordPress. The plugin is reportedly affected by an Authentication Bypass vulnerability in all versions up to, and including, 4.4.5. This vulnerability could enable unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account. This includes accounts with administrative privileges. The vulnerability is under investigation and no exploitation in the wild has been confirmed at this time.
The vulnerability was first flagged on 2026-08-30T05:16:58.407000+00:00 and has been assigned the identifier CVE-2026-15980 with a CVSS score of 9.8, indicating a critical severity level. The National Vulnerability Database (NVD) lists this vulnerability as critical. Users of the MyHome Core plugin should assess their exposure by checking their current version against the reported affected versions.
What to do about it
- Monitor the NVD and other primary sources for updates on the vulnerability and any available patches.
- Review your configurations to ensure they do not meet the conditions required for exploitation.
- Once a patched version of the MyHome Core plugin is available, upgrade to it immediately.
- Consider implementing additional security measures to protect against potential exploitation until a patch is released.
- Stay informed about the status of the vulnerability by consulting the primary sources regularly.
How 0Day would have caught this
myhome core plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the MyHome Core plugin for WordPress in versions up to, and including, 4.4.5, you are reportedly affected by this vulnerability.
What should I do right now?
Monitor the NVD and other primary sources for updates on the vulnerability and any available patches. Review your configurations and consider implementing additional security measures until a patch is released.
When will a patch be available?
No official fix has been published yet. Monitor the sources for updates on the availability of a patched version.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. The situation is under investigation.